@homeflare/alchemy 0.37.0 → 0.37.2

package/dist/proxmox/node-network-wire.d.ts

@@ -63,7 +63,7 @@ export interface NodeNetworkAttributes {
  *   read as "this interface is not there" — `diff` calls this directly and propagates every one
  *   of them loudly.
  */
-export declare const readInterfaceOrFail: (props: NodeNetworkProps) => Effect.Effect<typeof UNREADABLE | NodeNetworkAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readInterfaceOrFail: (props: NodeNetworkProps) => Effect.Effect<typeof UNREADABLE | NodeNetworkAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`'s adoption/recovery branch
  *   AND `reconcile` MAY USE IT — FOUND BY ADVERSARIAL REVIEW, 2026-09-24: a first draft used

package/dist/proxmox/node-network-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-wire.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,gBAAgB,EAOtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,UAAW,gBAAgB,m3BAmBxD,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,sIACmB,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,qBAAqB,GAAG,UAAU,GAAG,SAAS,sCAC3C,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAcnB,CAAC"}
+{"version":3,"file":"node-network-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network-wire.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,KAAK,gBAAgB,EAOtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,MAAM,GACN,QAAQ,GACR,KAAK,GACL,QAAQ,GACR,SAAS,GACT,MAAM,GACN,MAAM,CAAC;AAEX;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,UAAW,gBAAgB,ylCAmBxD,CAAC;AAEJ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,UAAW,gBAAgB,sIACmB,CAAC;AAEzE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,qBAAqB,GAAG,UAAU,GAAG,SAAS,sCAC3C,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,eAAgB,qBAAqB,SAAS,gBAAgB,YAcnB,CAAC"}

package/dist/proxmox/storage-wire.d.ts

@@ -40,19 +40,16 @@ export declare const same: <T>(declared: T | undefined, live: T) => boolean;
  *   `readUser`/`readGroup` do, so a brand-new declaration can still be created; `readStorageOrFail`
  *   (used by `diff`) does not.
  */
-export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | storage.StorageNotFound | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readStorageOrFail: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | storage.StorageNotFound | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT —
- *   user.ts's `readUser` has the full reasoning. Safe here because a wrongful fold costs at most a
- *   redundant `createStorage` POST, which PVE refuses loudly ("storage ID already exists") rather
- *   than silently corrupting anything.
- * ⛔ `storage.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
- *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
- *   nothing compared (the ORIGINAL cries-wolf bug this family shipped with, per unreadable-read.ts's
- *   own header). `diff` calls `readStorageOrFail` directly, so a genuine failure there propagates
- *   and fails the whole plan loudly instead.
+ * ⛔ ONLY `StorageNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readStorageOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readStorage: (props: StorageProps) => Effect.Effect<typeof UNREADABLE | StorageAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: StorageAttributes | Unreadable | undefined) => StorageAttributes | undefined;
 /**

package/dist/proxmox/storage-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,63BAGyC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,kIACuB,CAAC;AAEvE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}
+{"version":3,"file":"storage-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage-wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,OAAO,MAAM,kCAAkC,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,eAAO,MAAM,QAAQ,aAAc,MAAM,GAAG,SAAS,QAAQ,MAAM,YACN,CAAC;AAE9D,eAAO,MAAM,IAAI,GAAI,CAAC,YAAY,CAAC,GAAG,SAAS,QAAQ,CAAC,YACX,CAAC;AAwB9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,YAAY,mmCAGyC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UAAW,YAAY,qlCAG5C,CAAC;AAEJ,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,YAOjC,CAAC"}

package/dist/proxmox/unreadable-read.d.ts

@@ -18,10 +18,10 @@
  *   on a lane that cannot prove one is needed and (b) never takes the rest of the plan down with
  *   it — the "noop-with-warning" reading of the fix, over the alternative of a typed plan error.
  *
- * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Every other read failure (a genuine
- *   `Cause.TimeoutError`, `PveClusterExhausted`, a network error) keeps folding into `undefined`
- *   exactly as it always has — this narrows ONE typed tag out of that fold, via `catchTag`, and
- *   changes nothing else about it. See credential-errors.ts's own ⛔ for why 403 alone qualifies.
+ * ⛔ ONLY THE CREDENTIAL DENIAL IS CAUGHT HERE. Other errors propagate to the caller.
+ *   Legacy callers may still fold them, but the typed-absence follow-up makes User/Group/
+ *   Storage catch only their SDK missing-object tag. Never infer a resource is absent from
+ *   this sentinel. See credential-errors.ts's own ⛔ for why the OpenBao mint's 403 qualifies.
  */
 import * as Effect from 'effect/Effect';
 import type { PveCredentialDenied } from './credential-errors.ts';
@@ -29,9 +29,9 @@ import type { PveCredentialDenied } from './credential-errors.ts';
 export declare const UNREADABLE: unique symbol;
 export type Unreadable = typeof UNREADABLE;
 /**
- * Catches ONLY `PveCredentialDenied` and turns it into the sentinel, so a caller that also
- * `.pipe(Effect.orElseSucceed(() => undefined))` for every OTHER failure never conflates a
- * refusal with a genuine absence. Compose this INSIDE that fold, never after it.
+ * Catches ONLY `PveCredentialDenied` and returns the sentinel. Compose this BEFORE the
+ * caller's absence handling so a credential refusal cannot become a genuine absence.
+ * This helper itself classifies neither SDK missing-object tags nor transport failures.
  *
  * ⚠️ `E | PveCredentialDenied` IN, `E` OUT — not a generic `E` narrowed by `Exclude`. `catchTag`
  *   needs the tag to be STATICALLY present in the error union to typecheck at all; a bare

package/dist/proxmox/user-wire.d.ts

@@ -29,19 +29,16 @@ export declare const matches: (attributes: UserAttributes, props: UserProps) =>
  *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
  *   false `update` on every account.
  */
-export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | access.UserNotFound, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity | access.UserNotFound, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
- * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT. A
- *   missing user is a thrown 500 (user.ts's own header), so `reconcile`'s create branch NEEDS
- *   "absent" from a failure to ever run — without this fold, a brand-new account could never be
- *   created. Safe here because a wrongful fold costs at most a redundant `createAccessUser` POST,
- *   which PVE refuses loudly rather than silently corrupting anything.
- * ⛔ `user.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
- *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
- *   nothing compared. `diff` calls `readUserOrFail` directly, so a genuine failure there
- *   propagates and fails the whole plan loudly instead.
+ * ⛔ ONLY `UserNotFound` MEANS ABSENT. The initial distilled transport swap preserved a
+ *   catch-all fold because PVE reports missing objects as HTTP 500. SDK PR 265 now types that
+ *   measured message, so permission errors, unrelated 500s and exhausted transports propagate
+ *   instead of triggering a speculative create (decision 49 follow-up, 2026-09-24).
+ * ★ `readUserOrFail` remains the strict path used for an already-confirmed state row. This
+ *   change narrows cold reads/reconcile without changing that existing drift/diff contract.
  */
-export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 export declare const dropUnreadable: (live: UserAttributes | Unreadable | undefined) => UserAttributes | undefined;
 //# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,s3BAG+C,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,+HAC0B,CAAC;AAEpE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,4lCAG+C,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,klCACqD,CAAC;AAE/F,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}

package/dist/proxmox/user.d.ts

@@ -34,11 +34,11 @@
  *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.
  *
  * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, "no such user
- *   ('x@pve')". distilled turns that into an `InternalServerError`, with no distinct "not found"
- *   tag to catch. `user-wire.ts`'s `readUser` (used by `read`/`reconcile`, where the create
- *   workflow needs "absent" from exactly this failure) still folds it; `readUserOrFail` (used by
- *   `diff` below) does not — see that function's own header for why folding it there was the
- *   cries-wolf bug all over again, just for a genuine PVE quirk instead of a permission denial.
+ *   ('x@pve')". The first SDK migration exposed it as `InternalServerError`, so its create
+ *   workflow needed a catch-all fold. SDK PR #265 now recognizes `UserNotFound`; `readUser`
+ *   catches only that tag, letting other cold-read/reconcile failures propagate. The strict
+ *   `readUserOrFail` path for confirmed rows remains unchanged: its original transient-failure
+ *   fix stopped the cries-wolf update with nothing compared (user-wire.ts).
  *
  * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED
  *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —

package/dist/proxmox/zfs-pool-wire.d.ts

@@ -51,7 +51,7 @@ export declare const leafDevices: (children: unknown) => string[];
  *   `SETTLE_ATTEMPTS` (zfs-pool-form.ts's own ⚠️ on that); `readPoolOrFail` (used by `diff`) does
  *   not fold it, so a genuine transient failure there propagates and fails the plan loudly instead.
  */
-export declare const readPoolOrFail: (props: ZfsPoolProps) => Effect.Effect<typeof UNREADABLE | ZfsPoolAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const readPoolOrFail: (props: ZfsPoolProps) => Effect.Effect<typeof UNREADABLE | ZfsPoolAttributes | undefined, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | Error | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").Locked | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `createPool`'s settle-poll AND
  *   `read`/`reconcile` MAY USE IT — user.ts's `readUser` has the full reasoning. Safe here because

package/dist/proxmox/zfs-pool-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-wire.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aAAc,OAAO,KAAG,MAAM,EAO9C,CAAC;AAmBT;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,YAAY,+2BAe/C,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,YAAY,kIACuB,CAAC;AAEpE,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;;;;;;GAQG"}
+{"version":3,"file":"zfs-pool-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool-wire.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,aAAc,OAAO,KAAG,MAAM,EAO9C,CAAC;AAmBT;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,UAAW,YAAY,qlCAe/C,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,YAAY,kIACuB,CAAC;AAEpE,sGAAsG;AACtG,eAAO,MAAM,cAAc,SAAU,iBAAiB,GAAG,UAAU,GAAG,SAAS,kCACvC,CAAC;AAEzC;;;;;;;;GAQG"}

package/docs/changelog/README.md

@@ -0,0 +1,22 @@
+# Alchemy changelog archive
+
+Release history before 0.37.1, preserved in order. See the [current changelog](../../CHANGELOG.md).
+
+- [0.37.0](./archive-01.md)
+- [0.37.0 to 0.35.0](./archive-02.md)
+- [0.35.0 to 0.34.0](./archive-03.md)
+- [0.34.0 to 0.33.0](./archive-04.md)
+- [0.33.0 to 0.32.0](./archive-05.md)
+- [0.32.0 to 0.31.1](./archive-06.md)
+- [0.31.1 to 0.29.1](./archive-07.md)
+- [0.29.1 to 0.29.0](./archive-08.md)
+- [0.29.0 to 0.27.3](./archive-09.md)
+- [0.27.3 to 0.24.0](./archive-10.md)
+- [0.24.0 to 0.20.0](./archive-11.md)
+- [0.20.0 to 0.16.1](./archive-12.md)
+- [0.16.1 to 0.15.0](./archive-13.md)
+- [0.15.0 to 0.14.0](./archive-14.md)
+- [0.14.0 to 0.10.0](./archive-15.md)
+- [0.10.0 to 0.6.0](./archive-16.md)
+- [0.6.0 to 0.1.1](./archive-17.md)
+- [0.1.1 to 0.1.0](./archive-18.md)

package/docs/changelog/archive-01.md

@@ -0,0 +1,176 @@
+# Alchemy changelog archive 1
+
+[Current changelog](../../CHANGELOG.md) · [Archive index](./README.md)
+
+## 0.37.0
+
+### Minor Changes
+
+- [#262](https://github.com/taslabs-net/homeflare-kit/pull/262) [`ca1a558`](https://github.com/taslabs-net/homeflare-kit/commit/ca1a558db9101a8381dff57ba80f4aafcd01ae61) Thanks [@taslabs-net](https://github.com/taslabs-net)! - New `argocd/*` family — `Argocd.Repository`, `Argocd.RepoCreds` and `Argocd.Cluster`, on
+  `@distilled.cloud/argocd@1.0.0-rc.12` (measured published, matching the kit's own `effect`/core
+  pins — added as a direct peer dependency, the same shape as `forgejo`/`discord`). Built ahead of
+  need, per Tim's "we are using talos on pve once we get things settled ... i thought we are using
+  argocd, i wanted it on the radar" and "even if we don't use it yet but we know we will" — **no
+  Talos-on-PVE cluster and no Argo CD instance exist on the estate yet**; every test runs against a
+  fake, never a real server.
+
+  **Upstream check first (decision 49).** `alchemy-run/alchemy` v2.0.0-beta.79 ships no ArgoCD
+  provider at all — the only two `argocd` hits in the whole repo are an unrelated AWS EKS add-on
+  capability name in a JSDoc example. So there is nothing upstream to duplicate.
+
+  **The REST-vs-CRD split is the actual design decision, and it is why `Application`/`AppProject`
+  are deliberately NOT in this family.** Both are real Kubernetes CRDs (`argoproj.io/v1alpha1`,
+  their own versioned OpenAPI schema, listable with plain `kubectl`) — the upstream-correct owner is
+  Alchemy's own `Kubernetes.Manifest` (`src/Kubernetes/Manifest.ts`, which already documents a
+  "Custom resource (CRD)" example), not a house REST wrapper around the same object. Repository,
+  RepoCreds and Cluster are different: Argo CD's own storage for them is a `Secret` labeled with its
+  own private convention (`argocd.argoproj.io/secret-type: repository|repo-creds|cluster`) — not a
+  published Kubernetes API type, so the REST SDK is the only correct owner. Full reasoning, citations
+  and worked `Kubernetes.Manifest` examples for `Application`/`AppProject`:
+  `packages/alchemy/docs/argocd.md` and `docs/argocd-kubernetes.md`.
+
+  **A real, measured SDK-gap check that came back clean, unlike Discord's.** No `patches/` directory
+  exists for `packages/argocd` in distilled (homeflare/base) — every generated operation's own
+  declared `errors` array is just `[UnknownArgocdError]`. That looks like Discord's documented gap
+  (`docs/discord.md#sdk-gaps`) at first read. It is not: `protocol.ts` types every operation's shared
+  error channel from `API_ERRORS` (the full `HTTP_STATUS_MAP` set, not the narrower
+  `DEFAULT_ERRORS` Discord's channel is built from), and `core/protocol-rest.ts#decode` maps any
+  4xx status through `HTTP_STATUS_MAP` unconditionally after the per-op typed matchers, regardless
+  of what the operation itself declared. `catchTag('NotFound', ...)` works correctly today — proven
+  against the real protocol and a fake 404/401/403 in `repository.test.ts`, `repo-creds.test.ts` and
+  `cluster.test.ts`, not asserted by reading the source alone. No distilled patch was needed.
+
+  **Secrets never in state.** Every credential field (a repo's password/SSH key/bearer token/TLS
+  client key, a cluster's password/bearer token/TLS client key) is a prop typed `FromEnv`
+  (`../secrets/write-only.ts`), resolved from the deploying process's own environment at call time
+  and refused with a typed domain error when unset — never a literal value on a stack file, an
+  attribute, or in Alchemy's state store. No drift detection on those fields, the same
+  simplification `forgejo/org-actions-secrets.ts` already makes for the identical problem (Argo CD's
+  `Get`/`List` never returns them back): written once on create, rotated by destroy-then-create.
+
+  **Shape.** One shared engine (`resource.ts`) — a near-verbatim copy of `forgejo/resource.ts`, since
+  both SDKs are plain bearer-REST with a genuine typed `NotFound`. `reconcile` is a single upsert
+  call (every `Create*` operation this family calls takes `upsert: true` as a query parameter,
+  converging create-or-update in one request — no separate `Update*` path to wire). No `adopt(true)`/
+  `Unowned` wrapping, mirroring forgejo's own choice rather than discord's/netbox's marker.
+
+  **Tests**: 20 cases across the three resources, covering a live decode, a 404 folding to absent, a
+  401/403 propagating (never folded), idempotent delete (no DELETE call against an already-absent
+  object), and the write-only credential refusal/resolution path — all against `fake-argocd.ts`, a
+  loopback fake exercising the real distilled protocol, never a real Argo CD server.
+
+### Patch Changes
+
+- [#259](https://github.com/taslabs-net/homeflare-kit/pull/259) [`4302d28`](https://github.com/taslabs-net/homeflare-kit/commit/4302d28be200a04aa7b367a8a579134f864cd414) Thanks [@taslabs-net](https://github.com/taslabs-net)! - The `proxmox/*` family's Ceph sub-area, second of two PRs for 2c (decision 43's walk-down): migrates
+  `Proxmox.CephDaemon` (mon/mgr/mds) and `Proxmox.CephOsd` fully onto `@distilled.cloud/proxmox`.
+  Neither family had a forked-worker settle loop or an envelope-stripping dependency, so unlike
+  `Proxmox.NetworkApply`/`Proxmox.CephFs`'s delete, there is no protocol-level reason to leave either
+  on `client.ts` — both move completely.
+
+  **`Proxmox.CephDaemon`** replaces the generic `pveOperations`/`pveHandlers` factory (which cannot
+  run a distilled typed operation) with hand-written `read`/`diff`/`reconcile`/`delete`, matching the
+  factory's own pre-migration shape exactly: `matches` was always `() => true` and there is no PUT
+  for any of the three kinds, so a live daemon is always `noop` and drift is always `update`, never a
+  diff no write could satisfy. `nodes.updateNodeCephMon`/`Mgr`/`Mds` are distilled's generator
+  misnaming the create a POST "update" (checked against each one's `T.Http` annotation before
+  trusting the name); `nodes.listNodeCephMon`/`Mgr`/`Mds` and `nodes.deleteNodeCephMon`/`Mgr`/`Mds`
+  are the read and delete. One field rename: mon's `mon-address` maps to distilled's `mon_address`
+  (`T.Body("mon-address")`, confirmed against the schema) — the same one-key pattern
+  node-network-form.ts's `RENAMED` table carries for three fields.
+
+  **`Proxmox.CephOsd`** keeps its own pre-migration read behaviour exactly: `readOsd` (ceph-osd-tree.ts)
+  still has NO `Effect.orElseSucceed` — the tree endpoint is a collection that always exists while
+  Ceph is installed, so a read failure is never "the OSD is gone" and must propagate, never fold. This
+  is the one migrated Ceph family that does NOT match the single-fold shape `Proxmox.CephPool`/
+  `Proxmox.CephDaemon` carry, because it never had it before this PR either. `nodes.getNodeCephOsd`
+  (the tree), `nodes.createNodeCephOsd` and `nodes.deleteNodeCephOsd` map 1:1 to the existing forms.
+
+  **Both families keep every existing refusal byte-for-byte.** `Proxmox.CephOsd`'s create and delete
+  remain unreachable through this package's own credential — PVE registers `createosd`/`destroyosd`
+  with NO permissions block at all (root@pam only), confirmed again against distilled's own generated
+  schema, which changes nothing about that restriction. `Proxmox.CephDaemon`'s destroy still runs
+  against the daemon's own id path, never the collection `read` uses, avoiding the 501-that-looks-
+  like-a-permission-problem the pre-migration header already warned about.
+
+  **One pre-existing, out-of-scope finding, carried forward exactly rather than fixed here:**
+  `Proxmox.CephOsd`'s `destroyOsd` sends its `cleanup` flag as a request BODY on a DELETE, on
+  `client.ts` before this PR and on distilled after it alike — `client.ts`'s own `buildRequest` puts
+  `form` in the body for every HTTP method, and distilled's generated `DeleteNodeCephOsdRequest`
+  carries no `T.Query()` annotation on `cleanup` either, so it defaults to the same place. PVE's own
+  server (measured from `AnyEvent.pm`, the same fact `Proxmox.CephFs`'s delete was kept off distilled
+  for) never reads a body on DELETE — so `cleanup=1` was ALREADY silently ignored by the live cluster
+  before this migration. This is not a new regression, so it is not a reason to keep `destroyOsd` off
+  distilled the way `Proxmox.CephFs`'s delete was — but it is a real bug, unrelated to this PR, flagged
+  separately for its own fix (move `cleanup` into the query string, the way `destroyPath` in
+  ceph-fs-wire.ts already does for CephFs's own flags). It has zero live impact today either way,
+  since the whole DELETE 403s for this package's credential regardless of `cleanup`.
+
+  **One adversarial-review finding, fixed.** The hand-written `reconcile` returned early on
+  `if (live !== undefined) return live;` BEFORE calling `guardWrite` — the pre-migration factory
+  (`pveOperations.reconcile`, resource.ts) ran its create/update guard unconditionally right after
+  the read, because `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts
+  forces it after the probe even when `diff` said noop). Inert today, since `diff` guards every
+  normal plan — but a real gap for any caller that invokes `reconcile` directly (a resumed apply
+  from persisted state, a verify/adopt harness). Fixed to match `node-network.ts`'s own `reconcile`:
+  `guardWrite` now runs immediately after the read, unconditionally. `reconcileDaemon` is exported
+  so a test can call it directly, bypassing `diff` the same way the gap would have been reached.
+
+  **A related, separate finding, NOT fixed here — recorded to `decisions.md`'s open items.** Proving
+  the guard fix with an actual refused value turned up that `constraints.ts`'s `violations()` never
+  checks a bare `format` rule: `mon-address`'s own vendor entry is `{"format":"ip-list",
+"type":"string"}` with no `pattern`, and checked directly, `formViolations` returns `[]` for a
+  malformed address. `mds`/`mgr`'s create endpoints carry EMPTY constraint tables too. About 105
+  parameters across this whole package declare a `format`; none are enforced. This is a real,
+  pre-existing gap unrelated to distilled or this migration — the new test instead proves the
+  STRUCTURAL property (`guardWrite`, and the `createForm` it must evaluate, still run on the
+  adopted-row path, via a field getter that only `createForm` reads on that path), confirmed to fail
+  without the ordering fix by temporarily reverting it and re-running.
+
+  **New tests**, proven against a deliberately broken implementation before landing:
+  `ceph-daemon-write.test.ts` (a new mon POSTs `mon-address` as `mon_address` and reads the collection
+  back; a new mds POSTs `hotstandby`; `RemovalPolicy.destroy()` then undeclaring a mgr sends exactly
+  one DELETE — confirmed to fail without the real `deleteDaemon` call by temporarily stubbing it out)
+  and `ceph-osd-write.test.ts` (a new OSD POSTs `dev` and `crush-device-class` correctly and reads the
+  new leaf back by id — this test can never run against the real cluster, since the write it drives is
+  root-only, but it is the only way to catch a wire-translation bug a real deploy would never reach far
+  enough to expose).
+
+  **Expected after this releases and the consumer bumps:** no live plan change for either family — C1's
+  read-role lease could always read the live Ceph daemons and OSDs cleanly, so this is a transport
+  migration on tested paths, not a behaviour change.
+
+- [#257](https://github.com/taslabs-net/homeflare-kit/pull/257) [`5e1e1b7`](https://github.com/taslabs-net/homeflare-kit/commit/5e1e1b7dfd51cff7664c74284287e44e9caa9f3c) Thanks [@taslabs-net](https://github.com/taslabs-net)! - The `proxmox/*` family's Ceph sub-area, first PR of two (decision 43's serial proxmox walk-down,
+  2c — the four Ceph families, split pool+fs first, daemon+osd after): migrates `Proxmox.CephPool`
+  fully onto `@distilled.cloud/proxmox`, and migrates `Proxmox.CephFs`'s READ and CREATE onto it
+  while its DELETE stays on `client.ts` for a measured protocol reason.
+
+  **Every existing refusal and guard survives byte-for-byte — this is a transport swap, not a
+  redesign.** Both families keep the exact single-fold read shape they always had
+  (`Effect.orElseSucceed` after every failure, no `output`-branching): that is NOT the newer
+  dual-path pattern `Proxmox.NodeNetwork`/`Proxmox.ZfsPool`/`Proxmox.Storage` carry, and it is not
+  upgraded to it here — this PR's own rule is behaviour surviving unchanged, not gaining the newer
+  pattern along the way. Both `ceph-pool-wire.ts` and `ceph-fs-distilled.ts` say so in their own
+  headers, including the same-day latent gap this leaves (a refused OpenBao mint still folds to
+  "absent" on both families, the cries-wolf class already fixed elsewhere) — noted, not fixed, since
+  fixing it is a behaviour change this PR's rules do not ask for.
+
+  **`Proxmox.CephPool`: the PG-merge guard, and the absence signal, both measured live.** `GET
+/nodes/{node}/ceph/pool/{name}/status` on a name with no pool answers a generic HTTP 500 (measured
+  against TB4 `n2`, 2026-09-24, read-role, read-only probe:
+  `{"data":null,"message":"error with 'osd pool get': mon_cmd failed - unrecognized pool
+'<name>'\n"}`) — not a parsed field like `Proxmox.NodeNetwork`'s 400, so `confirmAbsent`
+  (ceph-pool-settle.ts) still asks the SECOND question — does the index list this name — before a
+  create is allowed to run, exactly as before. `confirmAbsent` now calls distilled's
+  `listNodeCephPool`; the settle loop (waiting out a forked worker) never used PVE's task-status
+  endpoint at all — it re-polls the pool's own status, so it needed no `Task.awaitTask` and carries
+  no NEW protocol risk. `createNodeCephPool`/`putNodeCephPool`/`deleteNodeCephPool` map 1:1 to the
+  existing form (no field renames this family needed).
+
+  **`Proxmox.CephFs`: reads and create move; delete does not, for a measured reason.** Distilled
+  types `DeleteNodeCephFsRequest`'s `remove_pools`/`remove_storages` as request-BODY fields
+  (`T.Body`) — checked directly against its generated schema. This family's own header already
+  carries the measured fact (from PVE's own `AnyEvent.pm`) that PVE's server reads a request body
+  only on PUT/POST; a DELETE's body is silently discarded, no error raised anywhere. Sending those
+  two safety flags through distilled's generated delete op as-is would silently drop them — the same
+  class of protocol gap `Proxmox.NetworkApply` was kept off distilled for. `destroyFs` therefore
+  stays on `client.ts`, unmigrated, in `ceph-fs-wire.ts`.

package/docs/changelog/archive-02.md

@@ -0,0 +1,180 @@
+# Alchemy changelog archive 2
+
+[Current changelog](../../CHANGELOG.md) · [Archive index](./README.md)
+
+The read (the directory index, `nodes.listNodeCephFs`) and the create (`nodes.updateNodeCephFs` —
+distilled's generator MISNAMES the create a "update"; checked directly against its `T.Http`
+annotation, it is genuinely `POST /nodes/{node}/ceph/fs/{name}`, PVE's only write on that path,
+harmless once named for what it is) both move to a new `ceph-fs-distilled.ts`. The create's forked-
+worker wait is its OWN function there, polling the RAW `nodes.getNodeTaskStatus` operation directly
+rather than `@distilled.cloud/proxmox`'s own `Task.awaitTask` — checked against `task.ts` before
+deciding: `Task.awaitTask` propagates a poll failure as a genuine typed error instead of treating
+it as "not settled yet", which would turn a missing `Sys.Audit` grant or a node mid-restart into a
+failed create instead of a patient one, the same failure mode `Proxmox.NetworkApply`'s own header
+already names. The raw operation carries none of that behaviour — it is a plain typed GET — so
+wrapping it in the SAME tolerant retry loop `ceph-fs-wire.ts`'s own (unmigrated, delete-only) poll
+already uses reproduces the exact policy: same cadence (`POLL_SECONDS`/`POLL_ATTEMPTS`, one
+constant, imported not retyped), same "an unreadable status is not a failure" tolerance.
+
+**Live measurement note.** This session's own OpenBao policy has no Proxmox grant; the live probes
+above ran through `homeflare-proxmox`'s `scripts/with-mini-bao.ts` (the `macmini-agent` AppRole's
+`read` role for TB4), from a detached worktree, read-only, per the coordinator's direction — not
+through this repo's own credentials, and nothing here reads one.
+
+**One distilled generator quirk recorded to the shared `distilled-sdk-path.md` memory**, since it
+is an upstream-distilled fact rather than a kit one: `DeleteNodeCephFsRequest` types
+`remove_pools`/`remove_storages` as `T.Body` on a DELETE, which PVE's own server never reads a
+body on — the same class of finding as `Proxmox.NetworkApply`'s two, worth the same upstream
+attention if `@distilled.cloud/proxmox` is ever patched again.
+
+**New tests**, every one proven against a deliberately weakened check before landing:
+`ceph-pool-write.test.ts` (a genuinely new pool creates once the index is confirmed empty; the
+PG-merge guard refuses a create when the index lists the name but the status read still fails —
+confirmed this fails without the guard by temporarily removing the `confirmAbsent` call and
+re-running; `RemovalPolicy.destroy()` then undeclaring sends exactly one DELETE) and
+`ceph-fs-write.test.ts` (a genuinely new filesystem POSTs, polls a forked task that answers
+`running` before `stopped`/`OK` — proving the poll loop actually loops — and reads the index back;
+a task that finishes with a real Ceph error dies with the task-log pointer rather than a false
+create).
+
+**`ceph-fs-delete.test.ts` (new, added after the adversarial review's finding).** The review's one
+substantive finding: `Proxmox.CephFs`'s `delete` handler is the single place in this PR that
+composes a distilled call (`readFs`, before and after) with the unmigrated hand-client one
+(`destroyFs`) inside one handler — the exact boundary this PR's whole design rests on — and that
+composition had zero test coverage anywhere in the repo, before or after the rest of this PR
+(each half was proven separately, never together, and the destroy is destructive and hard to
+reverse). Added two tests: a genuine `RemovalPolicy.destroy()` then undeclare, confirmed to fail
+(the read-back reports the filesystem still present) by temporarily removing the `destroyFs` call
+and re-running; and a filesystem removed by hand between the adopt and the undeclare, proving
+`delete` is a silent no-op rather than a false DELETE against an object already gone.
+
+**Expected after this releases and the consumer bumps:** no live plan change for either family —
+C1's read-role lease could always read the live Ceph objects cleanly, so this is a transport
+migration on tested paths, not a behaviour change.
+
+- [#261](https://github.com/taslabs-net/homeflare-kit/pull/261) [`ee3f452`](https://github.com/taslabs-net/homeflare-kit/commit/ee3f4526d8fa2991837a8d7931b2fb37df921eda) Thanks [@taslabs-net](https://github.com/taslabs-net)! - `@distilled.cloud/litellm` (interim, via `packages/distilled-litellm`): reverts `credentials.ts`
+  to `Effect.orDie` on a missing or misspelled `LITELLM_PROXY_URL`/`LITELLM_PROXY_API_KEY`.
+
+  Q6 of the 2026-09-24 walk-down (decision 49 "upstream wins"): distilled's own convention for a
+  missing credential is `Effect.orDie`, not a typed `ConfigError` — 73 of 80 `packages/*/src/credentials.ts`
+  end this way at `homeflare/base`, 78 of 80 at `origin/main`. A worktree commit (`4ad19154`) had
+  made LiteLLM's `Credentials` the one exception, declaring `Effect.Effect<Config, ConfigError>` and
+  dropping the `orDie`. Distilled is not silent on this convention, so the divergence was the house
+  going stricter than distilled's own practice on a point it already has an answer for — the thing
+  decision 49 says to stop doing. Reverted in the litellm worktree (`homeflare/litellm`
+  `cbd6bbb890066e57fb0224b96c27fca91d89e0a6`, a `git revert` of `4ad19154`, confirmed byte-identical
+  to `4ad19154`'s parent), gated on `typecheck:ci`/`specs:check`/`format:check`, then byte-copied
+  into `packages/distilled-litellm/src/credentials.ts` (confirmed with `diff -rq` against the
+  worktree's `src/`).
+
+  **The typed-error idea is not discarded**, just not spread further: it is written up as a HELD
+  upstream proposal in [`litellm.md`](../litellm.md#credentials) — distilled's
+  own `LitellmOpError` already declares `ConfigError` and threads a real credentials failure into an
+  operation's error channel, so the plumbing for a typed refusal genuinely exists; nobody has raised
+  it to `alchemy-run/distilled`, and this PR doesn't either.
+
+  **`packages/alchemy/src/litellm/operations.ts`'s `mutate` helper needed no functional change.**
+  Its `| ConfigError` widening was always redundant with the operation-level `LitellmOpError` union
+  (which declares `ConfigError` unconditionally, regardless of `Credentials`'s own type) — confirmed
+  by re-reading `protocol.ts` — so it still typechecks and the widening is still a real no-op for
+  callers. Its comment is corrected: it no longer claims resolving `Credentials` can itself fail
+  typed, since post-revert it cannot.
+
+  **Verified**: `bun run build:interim-packages`, `tsc --noEmit` for the whole `@homeflare/alchemy`
+  package, `bun test src/litellm` (28/28), and `packages/distilled-litellm`'s own `types` and
+  `smoke` — all clean.
+
+  No live plan change: this only affects what happens when the two env vars are missing or
+  misspelled, which was never a state this family's tests exercised as "succeeds."
+
+- [#266](https://github.com/taslabs-net/homeflare-kit/pull/266) [`c6f3f9a`](https://github.com/taslabs-net/homeflare-kit/commit/c6f3f9a33fa2ed72c5d73586fa74090582330cd0) Thanks [@taslabs-net](https://github.com/taslabs-net)! - Make `Cloudflare.R2BucketLock` deletion succeed when its bucket is already gone.
+  Read, reconcile and delete now propagate distilled's typed SDK failures instead of
+  turning them into `Effect.orDie` defects. Error identities such as `InvalidRoute`,
+  `TooManyRequests` and reconcile's `NoSuchBucket` remain available to callers.
+
+  This follows the lifecycle pattern in upstream `Cloudflare/R2/BucketSippy.ts` at
+  `alchemy@2.0.0-beta.79` (`473c3959`): catch the missing bucket only where it means
+  absence or successful deletion, and propagate other SDK errors without a blanket remap.
+  Walked against Cloudflare API v4 via `@distilled.cloud/cloudflare@1.0.0-rc.12`,
+  the version pinned by Alchemy beta.79. No props, attributes or SDK pins change.
+
+  Fake-transport tests cover missing-bucket reads and deletes, missing-bucket reconcile
+  failures, other 404 errors, and rate-limited reads/deletes with retries disabled.
+
+## 0.36.0
+
+### Minor Changes
+
+- [#255](https://github.com/taslabs-net/homeflare-kit/pull/255) [`74310b5`](https://github.com/taslabs-net/homeflare-kit/commit/74310b5fcbd6ab1ddbebe607c2693c34d664bf30) Thanks [@taslabs-net](https://github.com/taslabs-net)! - `grafana/*` ships `Grafana.NotificationPolicy` — third and last of the stacked PRs bringing Grafana
+  alerting provisioning under Alchemy (decision 40), completing the family alongside
+  `Grafana.ContactPoint`/`Grafana.MuteTiming`/`Grafana.MessageTemplate` (kit PR 250) and
+  `Grafana.AlertRuleGroup` (kit PR 254). Full detail, including what was measured against the SDK's
+  generated types versus Grafana's own docs (no live call was made in this PR):
+  `docs/grafana-notification-policy.md`.
+
+  **A singleton — adopt and update only.** Measured: `RouteGetPolicyTreeError` has no `NotFound`
+  case, so `fetchLive` never returns `undefined` — this resource has no create or delete in the sense
+  every sibling resource has, only ever `PUT`-replaces the one tree an instance has. `spec.create`
+  exists only because `GrafanaSpec`'s shared type requires it; it is never actually reached.
+
+  **`routeResetPolicyTree` needs TWO explicit gates, not one.** `defaultRemovalPolicy: 'retain'`
+  means Alchemy's engine never calls `destroy` at all unless a stack opts in with
+  `.pipe(RemovalPolicy.destroy())` — the convention every multi-object-cascade resource in this
+  family already uses. On top of that, `destroy` itself refuses to reset unless the resource's own
+  `allowReset: true` prop is set — even a stack that opted in at the Alchemy level still needs this.
+  Without it, `destroy` logs a warning and retains the tree. Two gates because `routeResetPolicyTree`
+  is uniquely destructive here: it wipes every route, receiver reference and matcher back to
+  Grafana's bare default for the WHOLE instance, not one object. A test proves `destroy` sends no
+  `DELETE` without `allowReset`, and that a foreign-provenance tree still refuses destroy even WITH
+  it.
+
+  **The tree is opaque `Record<string, unknown>`**, same reasoning as `Grafana.MuteTiming`'s
+  `timeIntervals` — Grafana's matcher-expression types (`Matchers`/`ObjectMatchers`/`MatchRegexps`)
+  are complex nested unions this family does not hand-model, and the SDK's own unmodeled-key
+  passthrough (measured for `Grafana.MuteTiming`, mute-timing.ts's file header) means an opaque
+  pass-through round-trips correctly regardless.
+
+  **Route order is significant**, same as `Grafana.AlertRuleGroup`'s rules — Alertmanager routes an
+  alert to the first matching route in array order, proven by a test that reverses the same two
+  routes and asserts a mismatch. **Foreign-provenance refusal** reuses `alerting-provenance.ts`
+  unchanged, including the missing-means-foreign fix an adversarial review of kit PR 250 established.
+  **Grafana-injected defaults** are tolerated the `subset-match.ts` way (the same mechanism
+  `Grafana.Dashboard`/`Grafana.ContactPoint` already rely on), not hand-normalized — not measured
+  against a live instance, since none exists in this house to read.
+
+  **Dropped-route warning**, mirroring kit PR 254's `Grafana.AlertRuleGroup` fix for the identical
+  risk: a whole-tree `PUT` replaces every route, so a nested route added out-of-band is removed with
+  no error. `notification-policy-drop-warning.ts`'s `warnOnDroppedRoutes` logs every dropped route by
+  receiver and dotted-index path, from both a local reimplementation of `diff` and from `update`
+  itself — never a refusal, since the tree stays the unit by design.
+
+  ⛔ **Fixed after an adversarial review of this PR: the identity the warning used collided across
+  the WHOLE TREE, not just among siblings.** The first version keyed every node by its own-fields
+  JSON alone in a `Set`; a duplicate route added anywhere in the tree matched an unrelated declared
+  node with the same fields and the drop went unwarned, even though the `PUT` still removes it —
+  worse than the "structural, siblings-only" limitation the original comment claimed. `FlatRoute.key`
+  (`notification-policy-model.ts`) is now the chain of ancestor own-fields from the root down to a
+  node (`\0`-joined) — order-insensitive among siblings, but distinct across different parents — and
+  `warnOnDroppedRoutes` counts each key as a MULTISET (live count vs. declared count) rather than
+  checking `Set` membership, so N identical live occurrences under one parent are dropped only past
+  however many the declaration itself repeats. Four tests pin this: a duplicate added live warns; a
+  plain sibling reorder doesn't; an identical route under a different, undeclared parent still warns;
+  and two declared duplicates against two live duplicates warns nothing.
+
+  Tests (`notification-policy.test.ts` + `-model.test.ts` + `-refusals.test.ts` +
+  `-drop-warning.test.ts`, split four ways to stay under the house's 250-line file cap, sharing
+  fixtures from `notification-policy-fixtures.ts`) use the family's existing `fake-grafana.ts`
+  harness and prove: a GET never carries a body; reconcile never sends a create-shaped write; a
+  foreign-provenance tree (explicit `"file"` or MISSING) refuses update while an explicit `""` is
+  writable; `destroy` never resets without `allowReset: true`; reordering routes shows `update`; and
+  the dropped-route warning's multiset identity behaves as described above.
+
+## 0.35.0
+
+### Minor Changes
+
+- [#254](https://github.com/taslabs-net/homeflare-kit/pull/254) [`e6788af`](https://github.com/taslabs-net/homeflare-kit/commit/e6788af70a34495af64d9bc0a4fce112e59bf561) Thanks [@taslabs-net](https://github.com/taslabs-net)! - `grafana/*` ships `Grafana.AlertRuleGroup` — second of three stacked PRs bringing Grafana alerting
+  provisioning under Alchemy (decision 40), on the same `@distilled.cloud/grafana@0.2.0` operations
+  as `Grafana.ContactPoint`/`Grafana.MuteTiming`/`Grafana.MessageTemplate`. `Grafana.NotificationPolicy`
+  follows in one more PR. Full detail, including what was measured against the SDK's generated types
+  versus Grafana's own docs (no live call was made in this PR): `docs/grafana-alerting-rules.md`.