@homeflare/alchemy 0.37.0 → 0.37.1

package/dist/proxmox/storage-wire.d.ts

@@ -42,17 +42,14 @@ export declare const same: <T>(declared: T | undefined, live: T) => boolean;
  */
 export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | storage.StorageNotFound | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT —
- *   user.ts's `readUser` has the full reasoning. Safe here because a wrongful fold costs at most a
- *   redundant `createStorage` POST, which PVE refuses loudly ("storage ID already exists") rather
- *   than silently corrupting anything.
- * ⛔ `storage.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
- *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
- *   nothing compared (the ORIGINAL cries-wolf bug this family shipped with, per unreadable-read.ts's
- *   own header). `diff` calls `readStorageOrFail` directly, so a genuine failure there propagates
- *   and fails the whole plan loudly instead.
+ * ⛔ ONLY `StorageNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readStorageOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: StorageAttributes | Unreadable | undefined) => StorageAttributes | undefined;
 /**

package/dist/proxmox/storage-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,63BAGyC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,kIACuB,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}
+{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,63BAGyC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,+2BAG5C,CAAC;AAEJ,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}

package/dist/proxmox/unreadable-read.d.ts

@@ -18,10 +18,10 @@
  *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with
  *   it — the "noop-with-warning" reading of the fix, over the alternative of a typed plan error.
  *
- * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Every other read failure (a genuine
- *   `Cause.TimeoutError`, `PveClusterExhausted`, a network error) keeps folding into `undefined`
- *   exactly as it always has — this narrows ONE typed tag out of that fold, via `catchTag`, and
- *   changes nothing else about it. See credential-errors.ts's own ⛔ for why 403 alone qualifies.
+ * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Other errors propagate to the caller.
+ *   Legacy callers may still fold them, but the typed-absence follow-up makes User/Group/
+ *   Storage catch only their SDK missing-object tag. Never infer a resource is absent from
+ *   this sentinel. See credential-errors.ts's own ⛔ for why the OpenBao mint's 403 qualifies.
  */
 import * as Effect from 'effect/Effect';
 import type { PveCredentialDenied } from './credential-errors.ts';
@@ -29,9 +29,9 @@ import type { PveCredentialDenied } from './credential-errors.ts';
 export declare const UNREADABLE: unique symbol;
 export type Unreadable = typeof UNREADABLE;
 /**
- * Catches ONLY `PveCredentialDenied` and turns it into the sentinel, so a caller that also
- * `.pipe(Effect.orElseSucceed(() => undefined))` for every OTHER failure never conflates a
- * refusal with a genuine absence. Compose this INSIDE that fold, never after it.
+ * Catches ONLY `PveCredentialDenied` and returns the sentinel. Compose this BEFORE the
+ * caller's absence handling so a credential refusal cannot become a genuine absence.
+ * This helper itself classifies neither SDK missing-object tags nor transport failures.
  *
  * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`
  *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare

package/dist/proxmox/user-wire.d.ts

@@ -31,17 +31,14 @@ export declare const matches: (attributes: UserAttributes, props: UserProps) =>
  */
 export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | access.UserNotFound, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT. A
- *   missing user is a thrown 500 (user.ts's own header), so `reconcile`'s create branch NEEDS
- *   "absent" from a failure to ever run — without this fold, a brand-new account could never be
- *   created. Safe here because a wrongful fold costs at most a redundant `createAccessUser` POST,
- *   which PVE refuses loudly rather than silently corrupting anything.
- * ⛔ `user.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
- *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
- *   nothing compared. `diff` calls `readUserOrFail` directly, so a genuine failure there
- *   propagates and fails the whole plan loudly instead.
+ * ⛔ ONLY `UserNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readUserOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: UserAttributes | Unreadable | undefined) => UserAttributes | undefined;
 //# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,s3BAG+C,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,+HAC0B,CAAC;AAEpE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,s3BAG+C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,42BACqD,CAAC;AAE/F,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}

package/dist/proxmox/user.d.ts

@@ -34,11 +34,11 @@
  *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.
  *
  * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, "no such user
- *   ('x@pve')". distilled turns that into an `InternalServerError`, with no distinct "not found"
- *   tag to catch. `user-wire.ts`'s `readUser` (used by `read`/`reconcile`, where the create
- *   workflow needs "absent" from exactly this failure) still folds it; `readUserOrFail` (used by
- *   `diff` below) does not — see that function's own header for why folding it there was the
- *   cries-wolf bug all over again, just for a genuine PVE quirk instead of a permission denial.
+ *   ('x@pve')". The first SDK migration exposed it as `InternalServerError`, so its create
+ *   workflow needed a catch-all fold. SDK PR #265 now recognizes `UserNotFound`; `readUser`
+ *   catches only that tag, letting other cold-read/reconcile failures propagate. The strict
+ *   `readUserOrFail` path for confirmed rows remains unchanged: its original transient-failure
+ *   fix stopped the cries-wolf update with nothing compared (user-wire.ts).
  *
  * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED
  *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —

package/docs/distilled-interim.md

@@ -34,9 +34,21 @@ changes and nothing else does.
 Follow `.agents/skills/distilled-sdk/SKILL.md` in the local distilled clone —
 Steps 1–8 (never Step 9, which pushes). One worktree per vendor, branch
 `homeflare/<vendor>`, off `homeflare/base`. Spec sourcing, `patches/`,
-`convert.ts`/`generate.ts`, typecheck, `pnpm format`, `pnpm specs:check`.
-Commit in the local clone only — ⛔ **never push it anywhere; no forks, no
-PRs, no issues or comments on `alchemy-run/distilled` from this route.**
+`convert.ts`/`generate.ts`, `pnpm typecheck:ci` (never plain `typecheck`,
+which skips generated code — `noCheck: true`), `pnpm format`,
+`pnpm specs:check`. Commit in the local clone only — ⛔ **never push it
+anywhere; no forks, no PRs, no issues or comments on `alchemy-run/distilled`
+from this route.**
+
+⚠️ **A vendor with no machine-readable spec still gets a `SPEC_REPOS` entry**
+(`stacks/distilled-submodules/SpecRepos.ts`) with `blocked` and a reason. Upstream's
+Slack entry is the precedent. A blocked entry still declares the mirror repository,
+but skips fetch scaffolding; it does not pretend there is a spec to fetch.
+Caddy follows it (Q7, decision 49, 2026-09-24): the local `homeflare/caddy` worktree's
+`packages/caddy/docs/provenance.md` records the admin-API spec search against Caddy
+2.11.4's Go source and website. Its admin-operation model is hand-authored, and its
+`SpecRepos.ts` entry records that reason. The separately discovered config-tree
+metadata is not an admin-operation specification.
 
 ### 2. Copy into a kit workspace package
 

package/docs/provider-standard.md

@@ -1,7 +1,11 @@
 # The provider standard
 
-Status: in force. Verified 2026-09-22 against `alchemy@2.0.0-beta.79` (tag
+Status: in force. Verified 2026-09-24 against `alchemy@2.0.0-beta.79` (tag
 `v2.0.0-beta.79`, commit `473c3959`) and the distilled commit that tag pins (`c2a78002`).
+Decision 49 ("upstream wins", 2026-09-24): where upstream has a rule or clear convention, the
+house follows it exactly, neither looser nor stricter; a house rule only fills a gap upstream
+is silent on. This update corrects S20 and clarifies S21 against the pinned source; it
+does not claim a new audit of every rule or family.
 
 This page is the kit-side statement of the house standard for a custom Alchemy provider.
 The full rule set is the `alchemy-provider-standard` skill in the estate's workflow plugin.
@@ -64,11 +68,25 @@ already ships is a finding, even when it works.
   CPU-only Node call (`node:crypto` `createHash`, `Buffer`) goes inside `Effect.sync`, which
   is upstream's own example. When a promise cannot be avoided, use `Effect.tryPromise`,
   never `Effect.promise`.
-- **No defects (S20).** Lifecycle operations contain no `Effect.orDie` and no
-  `Effect.die`. A refusal is a typed error.
-- **Typed errors (S21, S22).** Handle errors with `Effect.catchTag` over the SDK's union.
-  Where the kit generates its own client from a vendor schema, the status-to-tag mapping
-  lives in that client, once, and never in a resource.
+- **Lifecycle errors (S20).** Upstream's rule is: "Do not use `Effect.orDie` in the
+  lifecycle operations since this will crash the whole IaC engine."
+  Cite: `AGENTS.md@v2.0.0-beta.79#L630`. It names `Effect.orDie` in lifecycle operations;
+  S20 adds no separate ban on `Effect.die` or on code outside those operations.
+  `Effect.die` still creates a defect. The engine's narrow recovery exception is the
+  best-effort read for an interrupted create: `Effect.catchDefect` degrades a crashed
+  recovery read to nothing recovered (`packages/alchemy/src/Plan.ts@tag#L1447`,
+  `packages/alchemy/src/Apply.ts@tag#L2218`). Ordinary lifecycle calls have no such
+  recovery wrapper (`Plan.ts@tag#L1303-L1315`); this is not a general safe-defect path.
+  Expected refusals stay typed errors.
+- **Typed errors (S21, S22).** Handle errors with `Effect.catchTag` over the SDK's union;
+  other typed SDK errors can propagate unchanged, as upstream's R2 `BucketSippy` does.
+  The resource-specific-tag patch rule applies to errors **outside** that typed union
+  (`AGENTS.md@tag#L733-L738`). Where a package's protocol includes status classes in
+  its union (argocd, hetzner, fly-io and neon at distilled `c2a78002`), catch those tags
+  directly: upstream `Hetzner/Certificate.ts@tag#L251,L288-L291` catches `NotFound`
+  for absent reads and successful deletes. No replacement tag is needed for an already
+  typed `NotFound`. Where the kit generates its own client from a vendor schema, the
+  status-to-tag mapping lives in that client, once, and never in a resource.
 - **Credentials (S24).** Credentials come from an `alchemy/Auth` provider and a lazy
   Credentials service. Short-lived credentials are minted per call, never reused, and never
   taken as props.

package/docs/proxmox.md

@@ -21,3 +21,23 @@ or creates one from a template.
 - ★ **Measurements in the source name a reference cluster with placeholders**: `C1`, three nodes
   `node-b`, `node-c` and `node-d` with Ceph on a Thunderbolt mesh, and documentation addresses
   (RFC 5737). The shapes and counts are measured; the names and addresses are not the real ones.
+
+## Distilled read failures (2026-09-24)
+
+The SDK walk-down in [PR #265](https://github.com/taslabs-net/homeflare-kit/pull/265)
+added vendor-evidenced `UserNotFound`, `GroupNotFound`, `StorageNotFound` and
+`CephPoolNotFound` tags for PVE's missing-object HTTP 500s. The provider now catches
+those tags on cold User/Group/Storage reads and CephPool reads. Other SDK errors
+propagate unchanged; a failed CephFS or mon/mgr/mds index also fails rather than
+proving absence. Existing strict confirmed-row User/Group/Storage reads remain strict.
+
+`typed-absence.test.ts` drives the real SDK protocol through fake transport, then proves
+with Alchemy's engine that a failed cold read cannot send a create and an unreadable
+CephFS index cannot produce a successful delete. Existing adoption fixtures prove
+matching objects remain no-ops. Credential-denied warnings are still not live no-op
+evidence; use the consumer's authorized read lane and `hf-adopt-verify --all`.
+
+This is a scoped follow-up to the transport migration. CephFS delete still uses the old
+client despite the SDK's now-fixed DELETE query encoding; bounded task polling and
+other pre-existing provider refusals retain their own policies. No live writes are part
+of this validation. Released-consumer plans remain a separate gate from these fixtures.

package/docs/upstream-conformance-bun.md

@@ -0,0 +1,67 @@
+# The Bun line
+
+Status: extracted from the [conformance ledger](./upstream-conformance.md); its dated
+measurements and open findings are preserved below.
+
+These are non-test files under `src/` that the standard (S42) says must be portable. "Exp"
+marks files exported from a subpath `index.ts`. `git grep` on `origin/main` finds 23 non-test
+files under `src/` that call `Bun.*` or import `node:*`/`bun:*`. Six of them are outside
+S42's scope:
+
+- four loopback fakes (`caddy/fake-caddy.ts`, `openbao/fake-bao.ts`, `proxmox/fake-pve.ts`,
+  `proxmox/fake-pve-lxc.ts`), which are test-side under S44;
+- `proxmox/provision-cli-fake.ts`, which is used only by tests;
+- `verify/args.ts`, which belongs to the CLI and so is tooling under S43.
+
+That leaves 17 files. The table lists them, plus `provision-cli-fake.ts`, which should move
+out of `src/`. The six out-of-scope files still ship in the tarball's `src/`, but no export
+reaches them.
+⚠️ The first version of this table said 16 files and left out `launchd/job-form.ts`.
+⚠️ Corrected 2026-09-22: 14 of the 17 break upstream's rule. `launchd/job-form.ts`,
+`proxmox/write-only.ts` and `proxmox/pbs-notification-target-wire.ts` use only synchronous
+`node:crypto` or `Buffer`. Upstream allows those inside `Effect.sync`
+(`AGENTS.md@v2.0.0-beta.79#Workflow`), and 40 upstream `src/` files import `node:crypto`,
+among them `Fly/Secret.ts` and `Railway/Variable.ts`. They were listed under a blanket
+`node:*` ban that upstream does not have.
+
+| file                                                       | API                                          | exp | portable replacement                         |
+| ---------------------------------------------------------- | -------------------------------------------- | --- | -------------------------------------------- |
+| `openbao/cloudflare-roles-config.ts`                       | `Bun.YAML`                                   | yes | parse on the tooling side; pass data in      |
+| `openbao/digest.ts` (14 importers)                         | `Bun.CryptoHasher`                           | —   | `Crypto.digest` + hex; keep `canonical()` ⚠️ |
+| `openbao/cloudflare-parity-snapshot.ts`                    | `Bun.file`, `Bun.Glob`                       | —   | `FileSystem` + `Path`                        |
+| `openbao/approle-login-form.ts`                            | `Bun.file`                                   | —   | `FileSystem.readFileString`                  |
+| `openbao/approle-login-result.ts`                          | `Bun.inspect`                                | —   | a plain formatter                            |
+| `openbao/forgejo-bootstrap.ts`                             | `Bun.spawn`                                  | —   | unreferenced; `ChildProcessSpawner` or drop  |
+| `talos/credentials.ts`                                     | `Bun.write/file/env/randomUUIDv7`, `node:fs` | —   | `FileSystem.makeTempFileScoped`              |
+| `talos/kubeconfig.ts`                                      | `Bun.file`                                   | yes | `FileSystem`                                 |
+| `talos/talos-machine-config.ts`                            | `Bun.file`                                   | yes | `FileSystem`                                 |
+| `talos/values.ts`                                          | `Bun.YAML`, `node:crypto`                    | —   | tooling-side parse; hash may stay            |
+| `launchd/local-runner.ts`                                  | `node:child_process`, `node:fs/promises`     | yes | H3 above                                     |
+| `launchd/sudo-stage.ts`                                    | `node:fs/promises`, `node:os`, `node:path`   | —   | `FileSystem`, `Path`                         |
+| `launchd/job-form.ts`                                      | `node:crypto` (`createHash`)                 | —   | allowed in `Effect.sync`                     |
+| `linux/ssh-runner.ts`                                      | `node:child_process`, `node:crypto`          | yes | H3 above                                     |
+| `caddy/caddy-http-client.ts`                               | `node:http`, `node:stream` (unix socket)     | yes | inherent — an Effect `HttpClient`, not H3 ⚠️ |
+| `proxmox/write-only.ts`, `pbs-notification-target-wire.ts` | `node:crypto`, `node:buffer`                 | —   | allowed in `Effect.sync` ⚠️                  |
+| `proxmox/provision-cli-fake.ts`                            | `Bun.spawn`, `node:fs`                       | —   | test-only; move out of `src/`                |
+
+The ⚠️ rows:
+
+- `openbao/digest.ts`: every `Bao.*` family persists this digest in state, so a swap must
+  hash the same bytes (`canonical()`, lowercase hex), or every row plans an update.
+  `Crypto.digest` from `effect/Crypto` is in every stack's services and fails with a typed
+  error; `alchemy/Util/sha256` wraps WebCrypto in `Effect.promise`.
+- `proxmox/write-only.ts`: a salted scrypt seal with `timingSafeEqual`. No Alchemy helper
+  replaces it. A plain `sha256` would make a write-only secret cheap to brute-force from
+  state, and it would change the persisted seal format.
+- `caddy/caddy-http-client.ts`: unlike `launchd/local-runner.ts` and `linux/ssh-runner.ts`
+  (H3, plain `async` interfaces), this is already the Effect `HttpClient.HttpClient` the
+  distilled SDK's own protocol runs on — `node:http` here is the same kind of unavoidable,
+  bottom-of-the-stack platform adapter `@effect/platform-node`'s own `NodeHttpClient.ts` is,
+  extended with `socketPath` dialing (that module has none) because a unix socket is the
+  measured transport a local Caddy needs and neither `FetchHttpClient` (Bun-only `unix`
+  option) nor stock `NodeHttpClient` (URL-only) speaks one on both Bun and Node. There is no
+  more-portable replacement to point to; the file already conforms to S19 (no async/await,
+  no raw `Promise` — `Effect.callback`/`Effect.tryPromise` throughout).
+
+Test runners: 51 files import `node:test`/`node:assert` (openbao 42, proxmox 7, forgejo 1,
+talos 1), and 126 import `bun:test`. S43 says `bun:test`.

package/docs/upstream-conformance-conforms.md

@@ -0,0 +1,55 @@
+# Upstream conformance: conforming building blocks
+
+Status: extracted from the [conformance ledger](./upstream-conformance.md); its dated
+measurements and open findings are preserved below.
+
+- **`paperless/*` (`Tag`, `DocumentType`, `StoragePath`, `CustomField`)** — ✅ **S23 fixed
+  2026-09-24** (branch `claude2/distilled-paperless-family`, decision 43, mirroring the
+  netbox/forgejo migrations above). Every call now goes through `@distilled.cloud/paperless-ngx`'s
+  typed operations, `catchTag('NotFound', …)` replaced the status-carrying `PaperlessError`
+  union, and `client.ts`/`errors.ts`/`credentials.ts` are deleted. The shared
+  `matching.ts`/`matching-locate.ts` engine (locate-by-name before state, by `output.id` after —
+  PR 163) is unchanged in shape. Not published upstream yet, aliased onto
+  `@homeflare/distilled-paperless-ngx@0.3.0` — [distilled-interim.md](./distilled-interim.md).
+  State did not move: props/attributes stay byte-identical, proven by `tag.test.ts` and the full
+  PR 163 regression suite (`tag-identity.test.ts`) against a fake exercising the real distilled
+  protocol. ⛔ **Still diverges on credentials (S24):** `PAPERLESS_URL`/`PAPERLESS_TOKEN` are read
+  at call time, now through the SDK's `CredentialsFromEnv` — same divergence, unchanged by the
+  transport swap.
+- **`github/RepositoryRuleset`** (added 2026-09-23) closes the hazard the row above names:
+  probes by name (`read`/`reconcile` both), answers `Unowned` on a cold name match (H1),
+  normalizes before comparing so a matching live ruleset is a true noop, and refuses
+  (rather than silently drops) a live rule type it does not model. Two recorded
+  divergences: the type string sits in upstream's own `GitHub` namespace (H14), and the
+  client is Octokit rather than distilled because distilled's `S.Struct` request schemas
+  have no field for `require_extra_approval_for_unattributed_changes` (H15) — see
+  [repository-ruleset.md](./repository-ruleset.md). `declareRepoPolicy` is rewired onto
+  it; the row below is now describing upstream `GitHub.Ruleset` itself, which this family
+  does not touch and remains usable directly.
+- **`github/declareRepoPolicy`** composes upstream `GitHub.Repository` and
+  `GitHub.Ruleset`. Its one hazard is upstream's own: `Ruleset.read` returns `undefined`
+  without prior output, so a first deploy creates a duplicate
+  ([repo-policy.md](./repo-policy.md)). The fix belongs upstream: read by name and answer
+  `Unowned`. Since 2026-09-23 `declareRepoPolicy` no longer takes this path (see the
+  `RepositoryRuleset` row above); this remains accurate for upstream `Ruleset` on its own.
+- **`cloudflare/website.ts`** sets house defaults over upstream `Website.Astro` and
+  `Website.Vite`.
+- **`ownership/*`** is built only on `AdoptPolicy`, `Stack`, `State` and `Artifacts`. Its
+  apply-time re-check (H2) exists because beta.79 skips the adoption probe while props hold
+  an Output. That fix also belongs in the engine upstream.
+- **`verify/*`** (`hf-adopt-verify`) runs Alchemy's own planner. It exists because beta.79
+  labels every cold adoption as an update (H6).
+- **`google-workspace/*`** (new 2026-09-24, `Group`, `GroupMember`, `DomainAlias`, `OrgUnit`)
+  is built directly on `@distilled.cloud/google-workspace@1.0.0-rc.12`'s typed
+  `unstable/admin_directory_v1` operations from the first commit — no hand-rolled client ever
+  existed for it to migrate off (S23), so there is no `client.ts` deletion to record. Every
+  `fetchLive` is get-by-key with its own `catchTag('NotFound', …)`, the same split forgejo's and
+  netbox's engines use (resource.ts). Get-by-key rather than NetBox's list-then-disambiguate,
+  since Directory addresses every object this family models by a stable key. ⛔ **Diverges on
+  credentials, same shape as the rest of this ledger (S24):** `GOOGLE_ACCESS_TOKEN` is read at
+  call time through the SDK's own `CredentialsFromEnv` — but here the SDK provides no way to
+  MINT that token at all (no service-account/DWD support), so a Bun wrapper outside this
+  package (H8, unwritten by this PR) is load-bearing in a way NetBox's/Forgejo's simple
+  API-token env vars are not. SDK gaps (the `unstable/` service tree, no per-operation error
+  beyond the shared 4xx set, no group-alias update) and the full credential/scope setup:
+  [google-workspace.md](./google-workspace.md).

package/docs/upstream-conformance-families.md

@@ -0,0 +1,95 @@
+# Upstream conformance: remaining family findings
+
+Status: extracted from the [conformance ledger](./upstream-conformance.md); its dated
+measurements and open findings are preserved below.
+
+7. **`proxmox/*` is the model for S38.** Its types and constraints are generated from the
+   vendor schema, and a manifest records the version and sha256. It diverges in four ways:
+   - the generic factory's `read` returns plain attributes, so every family except `Lxc`
+     adopts silently, against the house's own H1;
+   - 27 `Effect.die` sites in non-test source (defect risk, not a separate S20 ban);
+   - 7 test files on `node:test`;
+   - `Pbs.*` type strings (H14).
+8. **`talos/*`.** Its `talosctl` calls go through `ChildProcessSpawner`, as upstream's Docker
+   provider does, which conforms. Its file handling uses `Bun.file`, `Bun.write`,
+   `Bun.YAML` and `node:fs` (S42), and it uses `Effect.promise` in 3 files (S19). The
+   kubeconfig it writes is meant to be consumed through upstream's
+   `Kubernetes.KubeConfig({ path })`.
+9. **`netbox/*` conforms mostly.** Its constraints are generated from NetBox 4.7.0's
+   OpenAPI. Adopting first is documented as deliberate.
+   - ✅ **S23 fixed 2026-09-23** (branch `claude2/distilled-netbox-family`, mirroring the
+     Forgejo migration above, decision 42). `Netbox.Prefix` now calls
+     `@distilled.cloud/netbox`'s typed `ipam` operations instead of a hand-rolled `Effect
+HttpClient` client. The old status-carrying `NetboxError` and its `cause.status ===
+404` check are gone entirely — `Netbox.Prefix` locates by a server-side list filter,
+     which never 404s (an empty page is a normal 200), so nothing here checks a status
+     code at all, a stronger form of the same rule `catchTag('NotFound', …)` enforces for
+     a family that reads by direct key. `client.ts` is deleted. Not published upstream
+     yet, so aliased onto `@homeflare/distilled-netbox@0.2.0` as a plain `dependencies`
+     entry, not a peer — [distilled-interim.md](./distilled-interim.md). State did not
+     move: props/attributes stay byte-identical, proven by the family's unchanged
+     existing tests plus new tests against a fake NetBox exercising the real distilled
+     protocol.
+   - ⛔ **Still diverges on credentials (S24):** `NETBOX_TOKEN` / `NETBOX_URL` are read at
+     call time, now through the SDK's `CredentialsFromEnv` rather than a hand-rolled
+     `token()` — same divergence, unchanged by the transport swap.
+10. **`litellm/*` has no upstream equivalent** (LiteLLM has no upstream Alchemy family, the
+    same situation `openbao/*` is in above), and conforms on the transport contract.
+    - ✅ **S23 fixed 2026-09-24** (branch `claude2/litellm-distilled`, mirroring the NetBox
+      migration above, decision 43). `LiteLLM.PassThroughEndpoint` now calls
+      `@distilled.cloud/litellm`'s typed `misc` operations (`operations.ts`) instead of a
+      hand-rolled `Effect HttpClient` client. The old status-carrying `LitellmBadRequestError`
+      family is gone: every failure the four operations declare (`BadRequest`, `NotFound` on
+      update, `UnprocessableEntity`, plus the shared `Unauthorized`/`TooManyRequests`/server
+      errors) is the SDK's own typed error, `catchTag`'d — `deletePassThroughEndpoint`'s
+      re-list-on-ambiguous-`BadRequest` trick (S21: a status-and-a-real-read decision, never
+      body text) is unchanged, now keyed on the tag instead of the status code. The
+      per-base-URL write semaphore this vendor's whole-list storage forces (docs/litellm.md)
+      is unchanged too — the SDK has no opinion on it, so it stays one layer above the typed
+      calls, in `operations.ts`. `client.ts` and the kit's own hand-generated
+      `generated/pass-through.ts` are both deleted (the SDK's `misc.PassThroughGenericEndpoint`
+      is the same shape, generated from the same LiteLLM 1.100.0 OpenAPI document — see
+      `codegen/manifest.json`'s `litellm-openapi` entry, left in place and unconsumed rather
+      than deleted, the same pattern the two UniFi entries already establish). Not published
+      upstream yet, so aliased onto `@homeflare/distilled-litellm@0.2.0` as a plain
+      `dependencies` entry, not a peer — [distilled-interim.md](./distilled-interim.md). State
+      did not move: props/attributes stay byte-identical, proven by the family's unchanged
+      existing tests (now against a fake LiteLLM exercising the real distilled protocol
+      through `FetchHttpClient.Fetch`, not a loopback `Bun.serve`) plus the engine-level
+      replace test through `fake-stack.ts`. No stack in this estate currently imports
+      `litellmProviders`/`LiteLLM.PassThroughEndpoint` (measured 2026-09-24 across
+      homeflare-landscape's own repositories, including this one's `stacks/`), so there is no
+      live plan to re-run.
+    - ⛔ **Still diverges on credentials (S24):** `LITELLM_PROXY_URL` / `LITELLM_PROXY_API_KEY`
+      are read at call time, now through the SDK's `CredentialsFromEnv` rather than a
+      hand-rolled `resolveCreds` — same divergence, unchanged by the transport swap.
+    - **Credentials resolution, decision 49 (2026-09-24):** the temporary typed-`ConfigError`
+      change was reverted in [PR #261](https://github.com/taslabs-net/homeflare-kit/pull/261).
+      `CredentialsFromEnv` retains distilled's own `Effect.orDie` convention. S20 forbids it
+      in lifecycle operations; it is not a separate credentials-layer prohibition. The same
+      shape in NetBox is therefore not an S20 follow-up. See [LiteLLM's Q6 resolution](./litellm.md#credentials).
+11. **Every family repeats `list: () => Effect.succeed([])`**, 30 times, and only
+    `R2BucketLock` and `MeshNode` declare `nuke`. The constructor already defaults `list`
+    (S12). **Fix:** write the reason where it differs, and declare `nuke: { skip: true }`
+    where nuke must never reach the object.
+12. **Resource JSDoc is not in upstream's generator format.** Zero files use `@resource`,
+    `**Example:**` or `### Section` (S31, H10). **Decision:** maintainer, because it moves
+    the house's glyph rationale into `//` comments.
+13. **Tests never use `alchemy/Test/Bun`.** Every lifecycle is proven against loopback
+    fakes (S28, H12). Live suites need a place to run, and that is a maintainer decision.
+14. **`discord/*` is new (2026-09-24, task-authorized, kit PR TBD) and built directly on
+    `@distilled.cloud/discord` — no hand-rolled `client.ts` ever existed to retire.**
+    `Discord.ApplicationCommand` and `Discord.GuildApplicationCommand` call the SDK's
+    typed operations, `catchTag`'d through the shared `DiscordOpError` union (S21), with no
+    status sniffing anywhere in `resource.ts`. It follows upstream's `Snippet.ts` reference
+    exactly for a marker-less API (S7, S8): a cold `read` returns `Unowned(attrs)`, and both
+    convenience constructors pipe `adopt(true)` (H5) — a stricter posture than `netbox/*`'s
+    documented H1 gap, not a repeat of it. Rate-limit handling is the SDK's own default
+    `Retry` policy (bounded: `Schedule.recurs(8)`, S26) — this family adds nothing on top.
+    Full detail, the live Halibut census and its ownership-handover sequence, and every SDK
+    gap: [`discord.md`](./discord.md). ⛔ **Diverges on S24/S25 the same way every distilled
+    family in this ledger does:** credentials are read at call time through the SDK's own
+    `CredentialsFromEnv`, not a house `alchemy/Auth` provider — unchanged from `netbox/*`
+    and `litellm/*`'s entries above. **Gap, not yet fixed:** no vendor constraint table
+    (unlike NetBox/Paperless); `options` passed through opaquely rather than modeled from
+    the schema (`docs/discord.md#sdk-gaps`).

package/docs/upstream-conformance-grafana.md

@@ -0,0 +1,106 @@
+# Upstream conformance: Grafana
+
+Status: extracted from the [conformance ledger](./upstream-conformance.md); its dated
+measurements and open findings are preserved below.
+
+15. **`grafana/*` (added 2026-09-24) ships only `Datasource` — a real SDK gap, not scope-trimming.**
+    Measured against the published `@distilled.cloud/grafana@1.0.0-rc.12` tarball's
+    `lib/services/grafana.d.ts` (4,938 lines): the package has no create/read/update/delete
+    operations for folders (only `updateFolderPermissions` exists), plain dashboards (only
+    snapshot/public-dashboard routes exist — no `POST /dashboards/db`, no
+    `GET/DELETE /dashboards/uid/{uid}`), alert rules or contact points (both have only a
+    `routeGet*Export` read-only route under `/v1/provisioning/`, no create/update/delete). S1
+    found no upstream `Alchemy` family for any of these either. Full detail:
+    [grafana.md](./grafana.md#the-sdk-gap--why-only-datasource-ships).
+
+    ✅ **S22 fixed 2026-09-24** (branch `claude2/distilled-grafana`): root cause measured to be
+    `skipDeprecated: true` dropping 64 operations Grafana's own spec marks `deprecated: true` in
+    favor of a separate, undocumented-here Kubernetes-apiserver route — not a spec omission. RFC-6902
+    patches un-deprecate exactly the 32 operations this finding named (folders, dashboards,
+    alerting-provisioning writes); the other 32 stay excluded. Shipped as
+    `@homeflare/distilled-grafana` (0.1.0 pre-release, 0.2.0 once this PR's `minor` changeset
+    releases it), aliased onto `@distilled.cloud/grafana` the same S22 route
+    `@homeflare/distilled-netbox` established. `Grafana.Datasource`'s props/attributes/generated code
+    are unchanged (diffed operation-by-operation against the prior commit).
+    - ⚠️ **Knowing departure from upstream (Q8, decision 49 "upstream wins", 2026-09-24, WI-13):**
+      upstream's own rule for a deprecated vendor API is to document it _out of scope_, not
+      implement it — "Deprecated APIs (superseded by Rulesets etc.) … are documented as out of
+      scope in `INDEX.md` rather than implemented" (A `AGENTS.md:155`). The 32 un-deprecated
+      operations above do the opposite: they are un-deprecated and implemented. The reason is that
+      there is no in-scope replacement to point at instead — Grafana's spec marks these
+      `deprecated: true` in favor of a Kubernetes-style aggregated apiserver under
+      `/apis/{folder,dashboard,...}.grafana.app/v1…`, and that route family is **absent from the
+      pinned spec entirely**: MEASURED 2026-09-24 in the grafana worktree
+      (`packages/grafana/specs/spec-mirror-grafana/specs/openapi3.json`), 0 of 207 paths start
+      with `/apis` — the un-deprecation patches' own descriptions already say the same thing
+      (`packages/grafana/patches/001-undeprecate-folders.patch.json`: "That newer route … [is] not
+      present in this spec at all"). Following upstream's rule literally here would mean shipping
+      no `Grafana.Folder`/`Dashboard`/alerting-provisioning family at all, on an API the kit
+      already needs. The departure is scoped to exactly these 32 operations; the other 32 stay
+      excluded, deprecated, out of scope, matching upstream on that half.
+
+    ✅ **`Grafana.Folder`/`Grafana.Dashboard` shipped** (PR 245, on top of the same
+    `@distilled.cloud/grafana` operations S22 unblocked) — the uid-required doctrine, the
+    provisioned-object refusal, the parentUid-is-create-only refusal and the volatile-field
+    normalization that makes an unchanged dashboard a true noop are all in
+    [grafana-folder-dashboard.md](./grafana-folder-dashboard.md), not repeated here.
+
+    ✅ **`Grafana.ContactPoint`/`Grafana.MuteTiming`/`Grafana.MessageTemplate` shipped** (kit PR
+    250, first of three stacked PRs — `Grafana.AlertRuleGroup` then `Grafana.NotificationPolicy`
+    follow):
+    the foreign-provenance refusal (`alerting-provenance.ts`, an allowlist of Grafana's own
+    `ProvenanceNone`/`ProvenanceAPI` values, measured against `pkg/services/ngalert/models` and
+    Grafana's v13.1 docs) and the secret-settings-ref seam (`secret-refs.ts`, shared with
+    `Grafana.Datasource`) are both new shared building blocks — full detail:
+    [grafana-alerting.md](./grafana-alerting.md).
+    - 🔴 **New SDK gap found, not fixed here:** `MuteTimeInterval`'s generated type has no
+      `provenance`/`version` fields, and the SDK's own `TimeInterval` type is missing the real
+      Alertmanager time-interval fields (`weekdays`/`times`/`months`/etc.) entirely — Grafana's real
+      API returns and accepts all of them. NOT a data-loss gap: `@distilled.cloud/core`'s response
+      decoding never runs a strict schema decode (`JSON.parse` + a key-rename pass that leaves any
+      unmodeled key verbatim — `protocol-http.ts`'s `mapKeys`, confirmed by driving the real
+      operation through this family's fake-Grafana harness), so `mute-timing.ts` reads/writes both
+      through a locally-widened type instead. Same S22 fix route as the other named gaps
+      (regenerate the distilled clone's spec, copy forward) — not attempted here, since
+      `packages/distilled-grafana/src/` is vendored and never hand-edited.
+    - Measured, read-only, same census as PR 245's: `teslamate-grafana` has no contact points, mute
+      timings or templates configured either (consistent with the alerting-provisioning gap having
+      been real, not merely unexploited).
+
+    ✅ **`Grafana.AlertRuleGroup` shipped** (kit PR 254, second of three, branched fresh off `main`
+    after PR 250 merged): group, not per-rule, is the unit — `PUT .../rule-groups/{Group}` owns
+    evaluation `interval` and the full ordered `rules[]` together, which per-rule operations
+    cannot express (no `interval` field, no reordering). Rule order is significant, proven by a
+    dedicated test. The per-rule provenance refusal (each `ProvisionedAlertRule.provenance`, since
+    the group type itself carries none) reuses `alerting-provenance.ts` unchanged, including the
+    missing-means-foreign fix from PR 250's review. A declared group whose folder does not exist
+    refuses as a typed `BadRequest` (`RoutePutAlertRuleGroupError` has no `NotFound` case) rather
+    than being auto-created — this resource never calls `Grafana.Folder`'s create path. A whole-group
+    write silently dropping a live rule not in the declaration (found by that PR's own adversarial
+    review) is now warned about loudly rather than silent, never a refusal. Full detail:
+    [grafana-alerting-rules.md](./grafana-alerting-rules.md).
+
+    ✅ **`Grafana.NotificationPolicy` shipped** (this PR, third and last of the stacked PRs,
+    branched fresh off `main` after PR 254 merged): a SINGLETON — `fetchLive` never returns
+    `undefined` (`RouteGetPolicyTreeError` has no `NotFound` case), so this resource has no create
+    or delete in the sense every sibling resource does, only adopt-and-update. `destroy` never
+    calls `routeResetPolicyTree` without an explicit `allowReset: true` prop, a gate independent of
+    (and in addition to) `defaultRemovalPolicy: 'retain'` — two gates, since resetting wipes the
+    WHOLE instance's routing back to Grafana's bare default, not one object. The tree is opaque
+    `Record<string, unknown>` (same reasoning as `mute-timing.ts`'s `timeIntervals` — Grafana's
+    matcher-expression types are complex unions this family does not hand-model), compared via
+    `subset-match.ts` for Grafana-injected-default tolerance, with route order significant. The
+    same dropped-item warning kit PR 254 introduced for rule groups is mirrored here for dropped
+    routes. Full detail: [grafana-notification-policy.md](./grafana-notification-policy.md).
+
+    This completes the alerting-provisioning family this project set out to cover.
+    - ⛔ **Same open gaps as `forgejo/*` and `netbox/*` above:** `read` never answers `Unowned`
+      (H1), and credentials come from an explicit env var NAME at call time rather than an
+      `alchemy/Auth` provider (S24) — here the house's own `grafanaCredentials(target)`, not the
+      SDK's `CredentialsFromEnv`, because more than one Grafana instance exists on this estate
+      (grafana.md's own Credentials section).
+    - Measured, read-only, on `teslamate-grafana.service` (CT100, `teslamate/grafana:4.2.0`,
+      Grafana 13.1.3): one datasource (file-provisioned, not API-managed — a live example this
+      family COULD adopt), dashboards baked into the image (not API-managed either way), and no
+      folders, alert rules or contact points configured — consistent with the gap being real
+      rather than merely unexploited. No stack yet imports `@homeflare/alchemy/grafana`.