@homeflare/alchemy 0.37.0 → 0.37.2

package/src/proxmox/ceph-fs-distilled.ts

@@ -1,21 +1,16 @@
 /**
- * `Proxmox.CephFs`'s distilled half: the index read and the create — see ceph-fs-wire.ts's own
- * header for why `destroyFs` stays there, on `client.ts`, unmigrated.
+ * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.
+ * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.
  *
  * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.
  *   Checked directly against its schema (`T.Http({ method: "POST", uri:
  *   "/nodes/{node}/ceph/fs/{name}" })`) rather than trusted from the function name — it is the
  *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.
  *
- * ★ THE SETTLE POLL IS A SEPARATE FUNCTION FROM ceph-fs-wire.ts's, NOT A SHARED ONE, because it
- *   calls a different task-status operation on a different transport — `nodes.getNodeTaskStatus`
- *   here, `pve()` there — but the POLICY is identical on purpose: same cadence
- *   (`POLL_SECONDS`/`POLL_ATTEMPTS`, imported, not retyped), same "an unreadable status is not
- *   settled yet, not a failure" tolerance. That tolerance is why this calls the RAW distilled
- *   operation directly rather than `@distilled.cloud/proxmox`'s own `Task.awaitTask` — CHECKED
- *   against its source (`task.ts`): it propagates a poll failure as a genuine typed
- *   `GetNodeTaskStatusError` instead of treating it as "not yet", which would turn a missing
- *   `Sys.Audit` grant or a node mid-restart into a failed create instead of a patient one.
+ * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus
+ *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node
+ *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;
+ *   SDK PR #265 removed it because polling policy belongs in the provider.
  */
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
@@ -26,15 +21,14 @@ import { runPve } from './distilled-pve.ts';
 /**
  * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.
  *
- * ⛔ FOLDS EVERY FAILURE TO `undefined`, matching the pre-migration `pveOperations.read` this
- *   family used (`resource.ts`, `Effect.orElseSucceed`) — the same single-fold shape
- *   ceph-pool-wire.ts's `readPoolStatus` preserves and explains: this migration's own rule is
- *   behaviour surviving byte-for-byte, not the newer dual-path pattern gaining a new family.
+ * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING FILESYSTEM. The transport swap
+ *   initially preserved the generic factory's catch-all fold. The 2026-09-24 follow-up removes it:
+ *   a failed list is not proof that a filesystem is missing. Task polling below retains its
+ *   separate bounded wait policy; it does not decide whether a resource exists.
  */
 export const readFs = (props: CephFsProps) =>
   runPve(props.target, 'read', false, nodes.listNodeCephFs({ node: props.node })).pipe(
     Effect.map((rows) => readRow(rows as unknown as Record<string, unknown>, props)),
-    Effect.orElseSucceed(() => undefined),
   );
 
 /** `updateNodeCephFs`'s own request shape — `createForm`, translated. No field is renamed. */
@@ -45,8 +39,11 @@ const toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>
     node: props.node,
   }) as unknown as nodes.UpdateNodeCephFsRequest;
 
-/** Wait for the create's forked task — the distilled twin of ceph-fs-wire.ts's `settle`. */
-const settleCreate = (props: CephFsProps, upid: string) =>
+/**
+ * Wait for a forked task. `exitstatus` is absent while running and exactly `OK` on success.
+ * ⚠️ T.Label encodes the colon-filled UPID as one path segment, as the hand client did.
+ */
+const settleTask = (props: CephFsProps, upid: string) =>
   Effect.gen(function* () {
     for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
       const status = yield* runPve(
@@ -98,5 +95,34 @@ export const createFs = (props: CephFsProps) =>
         ),
       );
     }
-    yield* settleCreate(props, upid);
+    yield* settleTask(props, upid);
+  });
+
+/**
+ * DELETE the filesystem, then wait for the worker.
+ *
+ * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
+ *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
+ *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
+ *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
+ *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
+ *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
+ */
+export const destroyFs = (props: CephFsProps) =>
+  Effect.gen(function* () {
+    const upid = yield* runPve(
+      props.target,
+      'provision',
+      true,
+      nodes.deleteNodeCephFs({
+        node: props.node,
+        name: props.name,
+        // ⛔ Query fields, never a DELETE body. Omitted/false retains PVE's safe default.
+        ...(props['remove-pools'] === true ? { remove_pools: '1' } : {}),
+        ...(props['remove-storages'] === true ? { remove_storages: '1' } : {}),
+      }),
+    ).pipe(Effect.catchTag('CephFsNotFound', () => Effect.succeed('')));
+    // ⚠️ Missing already is idempotent; every other SDK error propagates. The caller's
+    //   successful index read must still confirm absence after the DELETE or task.
+    if (upid !== '') yield* settleTask(props, upid);
   });

package/src/proxmox/ceph-fs-wire.ts

@@ -49,21 +49,13 @@
  *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong
  *   cause.
  *
- * ★ AS OF 2026-09-24 (decision 43's walk-down, 2c) THIS FILE IS `client.ts`'s HALF ONLY. The read
- *   (`readRow`) moved to `ceph-fs-distilled.ts`, and so did the create — `nodes.updateNodeCephFs`
- *   (distilled's own misnamed POST, confirmed against its `T.Http` annotation) plus a SEPARATE
- *   distilled `settle`, using the raw `getNodeTaskStatus` operation in its own tolerant poll loop
- *   rather than `Task.awaitTask`, which does not tolerate a poll failure the way this family needs
- *   (network-apply-read.ts's own header has the fuller reasoning). `destroyFs` stays HERE,
- *   unmigrated: distilled types `remove_pools`/`remove_storages` as `T.Body` on a DELETE, and the
- *   ⛔ two paragraphs up is the MEASURED reason PVE would silently ignore both flags if sent that
- *   way — a real protocol gap, not a judgement call. `settle` below is still shared where it can
- *   be: `createForm`/`objectPath`/`destroyPath` are pure and reused by the distilled file too.
+ * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because
+ *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding
+ *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;
+ *   this file keeps the pure forms, attributes and read-back failure messages. The protocol
+ *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.
  */
-import * as Effect from 'effect/Effect';
 import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
-import { pve } from './client.ts';
-import type { PveTarget } from './credentials.ts';
 import { csv, flag, int, text } from './values.ts';
 
 /**
@@ -100,9 +92,6 @@ export const readRow = (
   };
 };
 
-/** ⚠️ `exitstatus` is ABSENT while a task runs, and is the exact string `OK` only on success. */
-type TaskStatus = { readonly status?: string; readonly exitstatus?: string };
-
 /**
  * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`
  *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the
@@ -131,83 +120,6 @@ export const createForm = (props: CephFsProps): Record<string, string> => ({
   ...field('pg_num', props.pg_num === undefined ? undefined : String(props.pg_num)),
 });
 
-/** The delete target with its flags in the query string — see the ⛔ in the header. */
-const destroyPath = (props: CephFsProps) => {
-  const query = [
-    props['remove-pools'] === true ? 'remove-pools=1' : undefined,
-    props['remove-storages'] === true ? 'remove-storages=1' : undefined,
-  ].filter((part) => part !== undefined);
-  return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join('&')}`;
-};
-
-/**
- * Wait for a forked PVE task, and fail loudly rather than quietly.
- *
- * ⚠️ THE UPID IS PERCENT-ENCODED BECAUSE IT IS FULL OF COLONS — `UPID:node-b:00396D3A:…:root@pam:`
- *   (MEASURED shape, from `GET /nodes/node-b/tasks`) is ONE path segment, not seven. Encoding is what
- *   guarantees it arrives as one; PVE's router decodes each segment before matching. REASONED from
- *   the URI handling rather than measured — no task of this provider's has been polled yet.
- */
-const settle = (target: PveTarget, node: string, upid: string, what: string) =>
-  Effect.gen(function* () {
-    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
-      const status = yield* pve<TaskStatus>(
-        target,
-        'read',
-        'GET',
-        `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`,
-      ).pipe(
-        // ⚠️ AN UNREADABLE STATUS IS "NOT SETTLED YET", NOT A FAILURE. It is a missing Sys.Audit
-        //   (see the header) or a node mid-restart; either way the task is still the cluster's
-        //   business, and the cap is what ends the wait rather than one unlucky GET.
-        Effect.orElseSucceed(() => undefined),
-      );
-      if (status?.status === 'stopped') {
-        const exit = text(status.exitstatus);
-        if (exit === 'OK') return;
-        return yield* Effect.die(
-          new Error(
-            `${what}: PVE task ${upid} finished with "${exit === '' ? 'no exit status' : exit}". ` +
-              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +
-              `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`,
-          ),
-        );
-      }
-      // ⚠️ A BARE NUMBER IS MILLISECONDS to Effect's Duration, not seconds. The cap in the
-      //   message below is derived from the same constant so the two cannot drift apart.
-      yield* Effect.sleep(POLL_SECONDS * 1000);
-    }
-    return yield* Effect.die(
-      new Error(
-        `${what}: PVE task ${upid} was still running after ` +
-          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` +
-          'status could not be read. Check the task log, and check that the `read` role holds ' +
-          `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` +
-          'task owner and is answered 403 rather than told to wait.',
-      ),
-    );
-  });
-
-/**
- * DELETE the filesystem, then wait for the worker.
- *
- * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
- *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
- *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
- *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
- *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
- *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
- */
-export const destroyFs = (props: CephFsProps) =>
-  Effect.gen(function* () {
-    const upid = text(yield* pve<string>(props.target, 'provision', 'DELETE', destroyPath(props)));
-    // ⚠️ A DESTROY THAT ANSWERS WITHOUT A UPID IS NOT REFUSED HERE. `destroyfs` dies synchronously
-    //   with "no such cephfs" when the filesystem is already gone, which surfaces as a failed
-    //   DELETE; an empty answer that is not an error is best treated as already-absent, and the
-    //   caller's read-back is what proves it either way.
-    if (upid !== '') yield* settle(props.target, props.node, upid, destroyPath(props));
-  });
-
 /**
  * The two read-back failures, as messages rather than as guesses.
  *

package/src/proxmox/ceph-fs.ts

@@ -28,12 +28,11 @@
  *
  * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
  *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision
- *   43's walk-down, 2c — ceph-fs-distilled.ts). `destroyFs` STAYS on `client.ts`, unmigrated:
- *   distilled types the delete's `remove-pools`/`remove-storages` flags as a request BODY, and
- *   this file's own next ⛔ (unchanged from before this migration) is the measured reason PVE
- *   would silently ignore both on a DELETE sent that way — ceph-fs-wire.ts's header has the fuller
- *   evidence. `readFs`/`diff`/`reconcile` keep the SAME single-fold, present-is-settled shape this
- *   family always had; see ceph-pool-wire.ts's own header for why that is not a bug left unfixed.
+ *   43's walk-down, 2c — ceph-fs-distilled.ts). DELETE originally stayed on `client.ts`:
+ *   the SDK put its flags in a body that PVE discards (ceph-fs-wire.ts's history).
+ *   SDK 0.3.0 fixes the query binding; delete now uses it and catches only CephFsNotFound.
+ *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must
+ *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.
  *
  * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.
  *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either
@@ -68,8 +67,8 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { createFs, readFs } from './ceph-fs-distilled.ts';
-import { CEPH_FS_CREATE, createForm, destroyFs, notCreated, notDestroyed } from './ceph-fs-wire.ts';
+import { createFs, destroyFs, readFs } from './ceph-fs-distilled.ts';
+import { CEPH_FS_CREATE, createForm, notCreated, notDestroyed } from './ceph-fs-wire.ts';
 import { guardWrite } from './distilled-guard.ts';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 
@@ -223,19 +222,18 @@ export const ProxmoxCephFsProvider = () =>
          * ⛔ THE READ-BACK IS WHAT TURNS "the task said OK" INTO "it is actually gone": `destroyfs`
          *   refuses while a non-disabled `cephfs` storage still references the filesystem, and that
          *   refusal must fail the destroy rather than letting Alchemy drop the state entry for a
-         *   live object. `destroyFs` itself stays on `client.ts` — ceph-fs-wire.ts's own header has
-         *   the measured, protocol-level reason.
+         *   live object. `destroyFs` now uses the SDK query binding — ceph-fs-wire.ts preserves
+         *   the measured DELETE query-binding history.
          */
         delete: Effect.fn(function* ({ olds }) {
           /**
            * ⚠️ A FILESYSTEM SOMEBODY ALREADY REMOVED BY HAND IS NOT AN ERROR. `destroyfs` dies
            *   synchronously with "no such cephfs", which would fail every destroy of a stack whose
            *   filesystem was cleaned up outside Alchemy and leave the state entry unremovable
-           *   without editing the store. ⚠️ THE COST IS STATED PLAINLY: `readFs` folds a FAILED
-           *   read into "absent" (the storage.ts trap), so a read this credential cannot perform
-           *   turns this into a destroy that reports success having done nothing. That is not a
-           *   new hazard — a broken read defeats the read-back below in exactly the same way — but
-           *   it is the reason a 403 on this family must be fixed rather than lived with.
+           *   without editing the store. The original catch-all read fold could also report
+           *   success after a 403 without deleting anything, and could defeat read-back after a
+           *   write. `readFs` now propagates those failures: only a successful index with no
+           *   matching row may short-circuit this delete or confirm the filesystem is gone.
            */
           if ((yield* readFs(olds)) === undefined) return;
           yield* destroyFs(olds);

package/src/proxmox/ceph-pool-settle.ts

@@ -17,18 +17,19 @@ import type { PveRequirements } from './resource.ts';
  *   separable at all. `ops.read` — now `readPoolStatus` (ceph-pool-wire.ts) — is a module-level
  *   binding in ceph-pool.ts; importing it back would be a runtime cycle, and duplicating it would
  *   be two definitions of one path. Passing it is the pattern zfs-pool-write.ts already uses.
+ *   The error parameter preserves the reader's typed failures through settle; it is not `never`.
  */
-export type PoolRead = (
+export type PoolRead<E> = (
   props: CephPoolProps,
-) => Effect.Effect<CephPoolAttributes | undefined, never, PveRequirements>;
+) => Effect.Effect<CephPoolAttributes | undefined, E, PveRequirements>;
 
 /**
- * ⛔ THE GUARD ON THE CREATE. `read` folds a 403, a timeout and a node that is down into the same
- *   `undefined` as a pool that is genuinely missing — so "absent" is not evidence. This asks a
- *   second, different question: does the cluster LIST this pool? A failure is left to propagate
- *   rather than folded, so "I could not ask" fails the deploy instead of creating over live data.
- *   An empty list is trusted: the collection 403s when the role is too narrow rather than
- *   filtering, so `[]` really does mean a cluster with no pools.
+ * ⛔ THE GUARD ON THE CREATE. The original read folded 403s/timeouts into absence, so this
+ *   independent index check prevented creating over a live pool. The typed reader now
+ *   propagates those failures, but a `CephPoolNotFound` must still not override a listed pool:
+ *   the measured PG-merge risk warrants keeping both observations. Failed index reads also
+ *   propagate. An empty list is trusted: the collection refuses a narrow role with 403 rather
+ *   than filtering, so `[]` really does mean a cluster with no pools.
  *
  * ⚠️ `describe` IS STILL A PLAIN STRING (ceph-pool.ts builds it from `object`/`collection` in
  *   ceph-pool-form.ts) — this function no longer takes a `collection` PATH, since
@@ -61,9 +62,9 @@ export const confirmAbsent = (props: CephPoolProps, describe: string) =>
  * ⚠️ SHORT POLLS, LOW CAP: 2s apart, 30 tries, about a minute. A pool create takes seconds; one
  *   still unsettled after a minute is a fault to surface, not a wait to lengthen.
  */
-export const settle = (
+export const settle = <E>(
   props: CephPoolProps,
-  read: PoolRead,
+  read: PoolRead<E>,
   done: (live: CephPoolAttributes | undefined) => boolean,
 ) =>
   Effect.gen(function* () {

package/src/proxmox/ceph-pool-wire.ts

@@ -7,22 +7,13 @@
  *   PVE form, unaware distilled exists: this file is the ONLY place that translates one into a
  *   typed distilled request.
  *
- * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR user.ts/group.ts/storage.ts/zfs-pool.ts/
- *   node-network-wire.ts CARRY. THIS IS A DELIBERATE, MEASURED DIFFERENCE, NOT AN OVERSIGHT. Those
- *   families were BUILT with (or later given, after the NodeNetwork adversarial review) the
- *   dual-path pattern because their `diff`/`read` hooks needed to tell "genuinely absent" apart
- *   from "a transient failure" at specific call sites. CephPool's PRE-MIGRATION behaviour never
- *   had that distinction: `resource.ts`'s generic `pveOperations.read` — what `ops.read`/`ops.diff`
- *   called before this PR — folds EVERY failure into `undefined` unconditionally
- *   (`Effect.orElseSucceed(() => undefined)`, no `output`-branching, checked directly against
- *   `resource.ts` 2026-09-24). This migration's own rule is that every existing refusal and guard
- *   survives byte-for-byte — not that it gets upgraded on the way past. `readPoolStatus` below
- *   reproduces that exact single-fold shape; it does not add the newer pattern.
- * ⚠️ WORTH A LATER, SEPARATELY-SCOPED DECISION: this means CephPool (like CephDaemon) still folds
- *   a refused OpenBao mint into "absent" too, same as every other pre-`unreadable-read.ts` family
- *   — the cries-wolf class `Proxmox.NodeNetwork`/`Proxmox.ZfsPool`/`Proxmox.Storage` were fixed
- *   against. Noted here rather than fixed here, since fixing it is a behaviour change this PR's
- *   own rules do not ask for.
+ * ⛔ ONLY TYPED ABSENCE MAY REACH A CREATE. The transport migration deliberately preserved
+ *   `pveOperations.read`'s catch-all `Effect.orElseSucceed(() => undefined)` to avoid changing
+ *   behavior during the swap. That also hid refused credentials and transient failures, risking
+ *   a false update/create. SDK PR #265 added the measured `CephPoolNotFound` tag; the follow-up
+ *   now catches only it. One reader serves read/diff/reconcile/settle, so all propagate other
+ *   failures. `confirmAbsent` still checks the index before create: a missing status alone must
+ *   never override a pool that the index lists (the PG-merge incident, ceph-pool-settle.ts).
  */
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
@@ -72,9 +63,9 @@ const attributesOf = (live: unknown, props: CephPoolProps): CephPoolAttributes |
 };
 
 /**
- * The live pool, or `undefined` — folds every failure, exactly as `ops.read` did. Used by `read`,
- * `diff` (via `ceph-pool.ts`'s own hand-written `reconcile`, which predates the factory) and
- * `settle` (ceph-pool-settle.ts) alike, matching the ONE-function shape this family had before.
+ * The live pool, or `undefined` only for the SDK's measured `CephPoolNotFound`. The initial
+ * transport swap preserved `ops.read`'s catch-all fold; the 2026-09-24 follow-up removes that ambiguity.
+ * Read, reconcile and settle now propagate every other failure instead of assuming absence.
  *
  * ⛔ `verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — ceph-pool.ts's own header has the
  *   measured reason and the cost (two extra, unguarded mon commands PVE runs to answer it).
@@ -87,7 +78,7 @@ export const readPoolStatus = (props: CephPoolProps) =>
     nodes.getNodeCephPoolStatus({ name: props.name, node: props.node, verbose: '1' }),
   ).pipe(
     Effect.map((live) => attributesOf(live, props)),
-    Effect.orElseSucceed(() => undefined),
+    Effect.catchTag('CephPoolNotFound', () => Effect.succeed(undefined)),
   );
 
 /** The two endpoints, as the keys `guardWrite` (distilled-guard.ts) checks both forms against. */

package/src/proxmox/ceph-pool-write.test.ts

@@ -6,12 +6,10 @@
  * ★ THE ABSENCE SIGNAL IS THE MEASURED ONE. `GET .../pool/{name}/status` on a name with no pool
  *   answers HTTP 500 (live TB4 `n2`, 2026-09-24, read-role, read-only probe:
  *   `{"data":null,"message":"error with 'osd pool get': mon_cmd failed - unrecognized pool
- *   '<name>'\n"}`) — a generic failure, not a parsed field like `Proxmox.NodeNetwork`'s 400. That
- *   is why `readPoolStatus` (ceph-pool-wire.ts) folds every failure the same way `ops.read` always
- *   did, and why `confirmAbsent` (ceph-pool-settle.ts) asks a SECOND, different question — does
- *   the index list this name — before a create is allowed to run. `fakePve` (fake-pve.ts) cannot
- *   answer anything but HTTP 200, so this file builds its own stub the way
- *   zfs-pool-read-failure.test.ts does, to answer the measured 500 directly.
+ *   '<name>'\n"}`) — SDK PR #265 now recognizes it as `CephPoolNotFound`. Only that tag folds
+ *   to absence; unrelated 500s propagate. `confirmAbsent` (ceph-pool-settle.ts) still asks a
+ *   SECOND, different question — does the index list this name — before create may run.
+ *   `fakePve` only answers HTTP 200, so this file stubs the measured 500 directly.
  */
 import { describe, expect, test } from 'bun:test';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
@@ -28,10 +26,13 @@ const INDEX = `nodes/${NODE}/ceph/pool`;
 const OBJECT = `${INDEX}/${NAME}`;
 const STATUS = `${OBJECT}/status`;
 
-/** A generic 500 — the measured absence shape, indistinguishable from any other server error. */
+/** The measured missing-pool 500, classified by the SDK as `CephPoolNotFound`. */
 const absent = () =>
   Response.json(
-    { data: null, message: `error with 'osd pool get': mon_cmd failed - unrecognized pool` },
+    {
+      data: null,
+      message: `error with 'osd pool get': mon_cmd failed - unrecognized pool '${NAME}'\n`,
+    },
     { status: 500 },
   );
 

package/src/proxmox/group-wire.ts

@@ -97,20 +97,15 @@ export const readGroupOrFail = (props: GroupProps) =>
   );
 
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT.
- *   PVE's OWN missing-group answer is a thrown 500 (the ⛔ above), so `reconcile`'s create branch
- *   NEEDS "absent" from a failure to ever run at all — without this fold, a brand-new group could
- *   never be created, because its very-first read would always fail loudly. Safe here because a
- *   wrongful fold costs at most a redundant `createAccessGroup` POST, which PVE refuses loudly
- *   ("group already exists") rather than silently corrupting anything.
- * ⛔ `group.ts`'s `diff` does **NOT** use this — found 2026-09-24, the SAME bug class as the
- *   credential denial fix: folding a TRANSIENT failure (a `PveClusterExhausted`, the encoding bug
- *   above) into "absent" at PLAN TIME is exactly what forced a false `update` with nothing
- *   compared. `diff` calls `readGroupOrFail` directly instead, so a genuine failure there
- *   propagates and fails the whole plan loudly — never silently misreports one row.
+ * ⛔ ONLY `GroupNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readGroupOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
 export const readGroup = (props: GroupProps) =>
-  readGroupOrFail(props).pipe(Effect.orElseSucceed(() => undefined));
+  readGroupOrFail(props).pipe(Effect.catchTag('GroupNotFound', () => Effect.succeed(undefined)));
 
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export const dropUnreadable = (live: GroupAttributes | Unreadable | undefined) =>

package/src/proxmox/read-failure-propagation.test.ts

@@ -8,9 +8,9 @@
  *     field, never the whole declared props object — the root cause: distilled's `buildRequest`
  *     treats every OTHER key as an "unknown key" and attaches it as a JSON body to what must stay
  *     a bodyless GET, which a stricter fetch client refuses outright.
- *  2. `diff` must never fold a genuine (non-credential-denial) read failure into "absent" — only
- *     `read`/`reconcile` may, where a wrongful fold costs at most a redundant, loudly-refused
- *     create, never a silent wrong write.
+ *  2. `diff` must never fold a genuine (non-credential-denial) read failure into "absent".
+ *     The later typed-absence follow-up extends that protection to cold `read`/`reconcile`:
+ *     only the SDK's resource-specific missing-object tags may trigger a create.
  */
 import { describe, expect, test } from 'bun:test';
 import * as Layer from 'effect/Layer';
@@ -116,8 +116,8 @@ describe('a transient read failure fails the plan loudly, never a silent false u
   });
 
   // ★ A brand-new declaration's own create-from-a-500 path is already covered end to end by
-  //   user.test.ts's `missingAs500` fixture — `readUser`/`readGroup` (used by `reconcile`) kept
-  //   their fold on purpose, exactly so that path stays unaffected by this fix.
+  //   user.test.ts's `missingAs500` fixture. The typed-absence follow-up keeps that path by
+  //   catching `UserNotFound`, while unrelated 500s now propagate on cold reads too.
 });
 
 describe('the same fix, one command over: alchemy drift never reports a transient failure as missing', () => {

package/src/proxmox/storage-wire.ts

@@ -93,18 +93,17 @@ export const readStorageOrFail = (props: StorageProps) =>
   ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));
 
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT —
- *   user.ts's `readUser` has the full reasoning. Safe here because a wrongful fold costs at most a
- *   redundant `createStorage` POST, which PVE refuses loudly ("storage ID already exists") rather
- *   than silently corrupting anything.
- * ⛔ `storage.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
- *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
- *   nothing compared (the ORIGINAL cries-wolf bug this family shipped with, per unreadable-read.ts's
- *   own header). `diff` calls `readStorageOrFail` directly, so a genuine failure there propagates
- *   and fails the whole plan loudly instead.
+ * ⛔ ONLY `StorageNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readStorageOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
 export const readStorage = (props: StorageProps) =>
-  readStorageOrFail(props).pipe(Effect.orElseSucceed(() => undefined));
+  readStorageOrFail(props).pipe(
+    Effect.catchTag('StorageNotFound', () => Effect.succeed(undefined)),
+  );
 
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export const dropUnreadable = (live: StorageAttributes | Unreadable | undefined) =>