@homeflare/alchemy 0.37.1 → 0.37.2

package/docs/changelog/archive-18.md

@@ -0,0 +1,55 @@
+# Alchemy changelog archive 18
+
+[Current changelog](../../CHANGELOG.md) · [Archive index](./README.md)
+
+1. **`@effect/platform-node` was a devDependency**, so a consumer got
+   `Cannot find module '@effect/platform-node/NodeServices'`. Alchemy's module graph
+   reaches `Cloudflare/Workers/WorkerBridge` even when you only import `/proxmox`, so it
+   is a required peer, not an optional one.
+2. **The `effect` peer was ranged** `>=4.0.0-rc.112`, which resolves to rc.115 —
+   `TypeError: Config.string is not a function`. Effect's rc line is not
+   semver-compatible with itself, so a range is a promise this package cannot keep. Peers
+   are pinned exactly now.
+3. **`@effect/platform-node-shared` still resolves up** to rc.115 against effect rc.112
+   (`Cannot find module 'effect/ByteSize'`), because `platform-bun@rc.112` asks for
+   `^4.0.0-rc.112`. Only a consumer-side `overrides` block holds the set together, and the
+   README now says so with the exact block to paste.
+
+⛔ The smoke script was `echo '…exercised by the consuming stack'` — a check that cannot
+fail, which is how all three shipped. It now packs the tarball, installs it the way the
+README says, and **imports every subpath**, because each of these threw at import rather
+than at install.
+
+## 0.1.0
+
+### Minor Changes
+
+- [#25](https://github.com/taslabs-net/homeflare-kit/pull/25) [`309c644`](https://github.com/taslabs-net/homeflare-kit/commit/309c644d83c7149571f4caada135d1b8d141a484) Thanks [@taslabs-net](https://github.com/taslabs-net)! - New package: custom Alchemy providers for five systems the vendor has none for.
+
+  **`R2BucketLock`** — an R2 bucket's lock rules, declared rather than applied by hand. A
+  lock rule is a retention floor: while a rule covers an object, no API call, no lifecycle
+  rule and no credential can delete it.
+
+  ★ Alchemy 2.0.0-beta.77 has no lock property anywhere in its R2 namespace, so the
+  alternative was a runbook step a human runs once — and a plan can never show a missing
+  runbook step. Covering the gap with a resource makes the drift visible in `plan`.
+
+  ⛔ Deletion is refused by design: removing a lock removes a retention floor, which is the
+  one operation this resource exists to make hard.
+
+  ⚠️ `alchemy`, `cloudflare` and `effect` are **peers**, not dependencies — Alchemy's
+  resource registry and Effect's context both break if two copies load in one process.
+
+  **Also in this release** — the same treatment for four more systems, 140 files in all:
+
+  - **`/proxmox`** (61 source files) — ACLs, API tokens, backup jobs, Ceph, SDN, storage.
+  - **`/openbao`** (33) — mounts, policies, PKI/SSH/auth roles, Cloudflare role expansion.
+  - **`/forgejo`** (12) — branch protection, org secrets, labels, webhooks.
+  - **`/talos`** (8) — cluster bootstrap, machine config, health.
+
+  ⛔ **Import a subpath, never the root.** Each system carries its own client, so a root
+  barrel would pull Proxmox into a stack that only wanted Forgejo.
+
+  ★ **The barrels are deliberately smaller than the directories** — 70 exported symbols out
+  of 606 defined, chosen from what a real stack actually consumes. An `export *` would
+  publish every helper as API and make the next refactor a breaking change.

package/docs/proxmox.md

@@ -37,7 +37,13 @@ CephFS index cannot produce a successful delete. Existing adoption fixtures prov
 matching objects remain no-ops. Credential-denied warnings are still not live no-op
 evidence; use the consumer's authorized read lane and `hf-adopt-verify --all`.
 
-This is a scoped follow-up to the transport migration. CephFS delete still uses the old
-client despite the SDK's now-fixed DELETE query encoding; bounded task polling and
-other pre-existing provider refusals retain their own policies. No live writes are part
+This is a scoped follow-up to the transport migration. CephFS delete now uses SDK 0.3.0's fixed
+DELETE query binding and folds only CephFsNotFound. Its existing destructive flags,
+bounded task polling and final index read remain in place. Other provider families
+retain their own policies. No live writes are part
 of this validation. Released-consumer plans remain a separate gate from these fixtures.
+
+`ceph-fs-destroy-sdk.test.ts` verifies that remove-pools/remove-storages are query
+parameters with an empty DELETE body, omitted flags retain the safe defaults, an
+already-missing filesystem succeeds, and unrelated 401/403/500 responses fail.
+The engine destroy fixture still proves the complete read/delete/poll/read-back flow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.37.1",
+  "version": "0.37.2",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
@@ -124,8 +124,8 @@
     "@distilled.cloud/netbox": "npm:@homeflare/distilled-netbox@0.3.0",
     "@distilled.cloud/opnsense": "npm:@homeflare/distilled-opnsense@0.2.0",
     "@distilled.cloud/paperless-ngx": "npm:@homeflare/distilled-paperless-ngx@0.3.0",
-    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.0",
-    "@distilled.cloud/proxmox-backup": "npm:@homeflare/distilled-proxmox-backup@0.3.0",
+    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.1",
+    "@distilled.cloud/proxmox-backup": "npm:@homeflare/distilled-proxmox-backup@0.3.1",
     "@distilled.cloud/unifi-network": "npm:@homeflare/distilled-unifi-network@0.2.0"
   },
   "peerDependencies": {

package/src/proxmox/ceph-fs-delete.test.ts

@@ -1,11 +1,8 @@
 /**
- * `Proxmox.CephFs`'s destroy path — the one place in this migration that composes a distilled
- * call (`readFs`, before and after) with a hand-client one (`destroyFs`, unmigrated — ceph-fs-
- * wire.ts's header has the measured protocol reason) inside a single handler. Flagged by
- * adversarial review as untested anywhere in the repo before this file: `readFs` alone is proven
- * by ceph-fs-write.test.ts and ceph-adopt.test.ts, `destroyFs` alone is unchanged from main, but
- * the two composed together — on a destructive, hard-to-reverse `RemovalPolicy.destroy()` — had
- * no coverage of the seam itself.
+ * The CephFS destroy lifecycle through the real SDK protocol and Alchemy engine.
+ * The original transport walk left DELETE on the hand client; SDK 0.3.0's query
+ * binding now permits the whole sequence to move. These tests keep the destructive
+ * read/delete/poll/read-back boundary covered without touching a real filesystem.
  */
 import { describe, expect, test } from 'bun:test';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
@@ -27,7 +24,7 @@ const declared = () => ProxmoxCephFs(NAME, { name: NAME, node: NODE, target: FAK
 describe('destroying a CephFS', () => {
   test(
     'RemovalPolicy.destroy() then undeclaring: readFs (distilled) finds it, destroyFs ' +
-      '(client.ts) removes it, and the distilled read-back confirms it is gone',
+      '(distilled) removes it, and the distilled read-back confirms it is gone',
     async () => {
       let destroyed = false;
       const fake = fakePve((call: PveCall) => {

package/src/proxmox/ceph-fs-destroy-sdk.test.ts

@@ -0,0 +1,98 @@
+/** The real SDK must send destructive flags in the query and fold only its missing-FS tag. */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { destroyFs } from './ceph-fs-distilled.ts';
+import { FAKE_TARGET, withoutBao } from './fake-pve.ts';
+
+const props = { name: 'oldfs', node: 'node-b', target: FAKE_TARGET };
+const UPID = 'UPID:node-b:fake:destroyfs';
+const fixture = (answer: () => Response) => {
+  const calls: { method: string; path: string; body: string }[] = [];
+  const stub = async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+    const request =
+      input instanceof Request ? new Request(input, init) : new Request(String(input), init);
+    const url = new URL(request.url);
+    if (url.pathname.includes('/creds/')) {
+      return Response.json({
+        data: { secret: 'fake-secret-not-real', token_id: 'hf-test@pve!fake' },
+        lease_duration: 0,
+      });
+    }
+    calls.push({
+      method: request.method,
+      path: url.pathname + url.search,
+      body: await request.text(),
+    });
+    return request.method === 'DELETE'
+      ? answer()
+      : Response.json({ data: { status: 'stopped', exitstatus: 'OK' } });
+  };
+  const layer = FetchHttpClient.layer.pipe(
+    Layer.provideMerge(
+      Layer.succeed(
+        FetchHttpClient.Fetch,
+        Object.assign(stub, { preconnect: globalThis.fetch.preconnect }) as typeof fetch,
+      ),
+    ),
+  );
+  return { calls, layer };
+};
+
+describe('CephFS distilled delete', () => {
+  test('destructive flags reach the query, never the DELETE body, and the worker is polled', async () => {
+    const fake = fixture(() => Response.json({ data: UPID }));
+    await withoutBao(() =>
+      Effect.runPromise(
+        destroyFs({ ...props, 'remove-pools': true, 'remove-storages': true }).pipe(
+          Effect.provide(fake.layer),
+        ),
+      ),
+    );
+    expect(fake.calls[0]).toEqual({
+      method: 'DELETE',
+      path: '/api2/json/nodes/node-b/ceph/fs/oldfs?remove-pools=1&remove-storages=1',
+      body: '',
+    });
+    expect(fake.calls[1]?.path).toBe(
+      `/api2/json/nodes/node-b/tasks/${encodeURIComponent(UPID)}/status`,
+    );
+  });
+
+  test('omitted or false flags preserve the safe defaults', async () => {
+    const fake = fixture(() => Response.json({ data: UPID }));
+    await withoutBao(() =>
+      Effect.runPromise(
+        destroyFs({ ...props, 'remove-pools': false }).pipe(Effect.provide(fake.layer)),
+      ),
+    );
+    expect(fake.calls[0]).toEqual({
+      method: 'DELETE',
+      path: '/api2/json/nodes/node-b/ceph/fs/oldfs',
+      body: '',
+    });
+  });
+
+  test('a race that already removed the filesystem is idempotent without a task poll', async () => {
+    const fake = fixture(() =>
+      Response.json({ data: null, message: "no such cephfs 'oldfs'\n" }, { status: 500 }),
+    );
+    await withoutBao(() => Effect.runPromise(destroyFs(props).pipe(Effect.provide(fake.layer))));
+    expect(fake.calls).toHaveLength(1);
+  });
+
+  for (const status of [401, 403, 500]) {
+    test(`an unrelated HTTP ${String(status)} fails instead of claiming deletion`, async () => {
+      const fake = fixture(() =>
+        Response.json({ data: null, message: 'refused or unavailable' }, { status }),
+      );
+      await withoutBao(async () => {
+        await expect(
+          Effect.runPromise(destroyFs(props).pipe(Effect.provide(fake.layer))),
+        ).rejects.toBeDefined();
+      });
+      expect(fake.calls).toHaveLength(1);
+    });
+  }
+});

package/src/proxmox/ceph-fs-distilled.ts

@@ -1,20 +1,16 @@
 /**
- * `Proxmox.CephFs`'s distilled half: the index read and the create — see ceph-fs-wire.ts's own
- * header for why `destroyFs` stays there, on `client.ts`, unmigrated.
+ * `Proxmox.CephFs`'s distilled transport: index, create, delete and task status.
+ * SDK 0.3.0 fixes DELETE query flags and supplies the measured CephFsNotFound tag.
  *
  * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.
  *   Checked directly against its schema (`T.Http({ method: "POST", uri:
  *   "/nodes/{node}/ceph/fs/{name}" })`) rather than trusted from the function name — it is the
  *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.
  *
- * ★ THE SETTLE POLL IS A SEPARATE FUNCTION FROM ceph-fs-wire.ts's, NOT A SHARED ONE, because it
- *   calls a different task-status operation on a different transport — `nodes.getNodeTaskStatus`
- *   here, `pve()` there — but the POLICY is identical on purpose: same cadence
- *   (`POLL_SECONDS`/`POLL_ATTEMPTS`, imported, not retyped), same "an unreadable status is not
- *   settled yet, not a failure" tolerance. That tolerance is why this calls the RAW distilled
- *   operation directly. The former SDK `Task.awaitTask` propagated poll failures; SDK PR #265
- *   removed that helper because polling policy belongs in the provider. This bounded wait
- *   still tolerates a missing `Sys.Audit` grant or a node mid-restart until its deadline.
+ * ★ CREATE AND DELETE SHARE THE SAME BOUNDED POLL POLICY. The raw getNodeTaskStatus
+ *   operation preserves this family's tolerance of a missing Sys.Audit grant or a node
+ *   mid-restart until the deadline. The former SDK Task.awaitTask propagated poll failures;
+ *   SDK PR #265 removed it because polling policy belongs in the provider.
  */
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
@@ -43,8 +39,11 @@ const toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>
     node: props.node,
   }) as unknown as nodes.UpdateNodeCephFsRequest;
 
-/** Wait for the create's forked task — the distilled twin of ceph-fs-wire.ts's `settle`. */
-const settleCreate = (props: CephFsProps, upid: string) =>
+/**
+ * Wait for a forked task. `exitstatus` is absent while running and exactly `OK` on success.
+ * ⚠️ T.Label encodes the colon-filled UPID as one path segment, as the hand client did.
+ */
+const settleTask = (props: CephFsProps, upid: string) =>
   Effect.gen(function* () {
     for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
       const status = yield* runPve(
@@ -96,5 +95,34 @@ export const createFs = (props: CephFsProps) =>
         ),
       );
     }
-    yield* settleCreate(props, upid);
+    yield* settleTask(props, upid);
+  });
+
+/**
+ * DELETE the filesystem, then wait for the worker.
+ *
+ * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
+ *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
+ *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
+ *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
+ *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
+ *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
+ */
+export const destroyFs = (props: CephFsProps) =>
+  Effect.gen(function* () {
+    const upid = yield* runPve(
+      props.target,
+      'provision',
+      true,
+      nodes.deleteNodeCephFs({
+        node: props.node,
+        name: props.name,
+        // ⛔ Query fields, never a DELETE body. Omitted/false retains PVE's safe default.
+        ...(props['remove-pools'] === true ? { remove_pools: '1' } : {}),
+        ...(props['remove-storages'] === true ? { remove_storages: '1' } : {}),
+      }),
+    ).pipe(Effect.catchTag('CephFsNotFound', () => Effect.succeed('')));
+    // ⚠️ Missing already is idempotent; every other SDK error propagates. The caller's
+    //   successful index read must still confirm absence after the DELETE or task.
+    if (upid !== '') yield* settleTask(props, upid);
   });

package/src/proxmox/ceph-fs-wire.ts

@@ -49,21 +49,13 @@
  *   Grant it on the `read` role, or every create burns the full cap below and reports the wrong
  *   cause.
  *
- * ★ AS OF 2026-09-24 (decision 43's walk-down, 2c) THIS FILE IS `client.ts`'s HALF ONLY. The read
- *   (`readRow`) moved to `ceph-fs-distilled.ts`, and so did the create — `nodes.updateNodeCephFs`
- *   (distilled's own misnamed POST, confirmed against its `T.Http` annotation) plus a SEPARATE
- *   distilled `settle`, using the raw `getNodeTaskStatus` operation in its own tolerant poll loop
- *   rather than `Task.awaitTask`, which does not tolerate a poll failure the way this family needs
- *   (network-apply-read.ts's own header has the fuller reasoning). `destroyFs` stays HERE,
- *   unmigrated: distilled types `remove_pools`/`remove_storages` as `T.Body` on a DELETE, and the
- *   ⛔ two paragraphs up is the MEASURED reason PVE would silently ignore both flags if sent that
- *   way — a real protocol gap, not a judgement call. `settle` below is still shared where it can
- *   be: `createForm`/`objectPath`/`destroyPath` are pure and reused by the distilled file too.
+ * ★ THE ORIGINAL DISTILLED WALK MOVED READ AND CREATE FIRST, leaving DELETE here because
+ *   SDK flags were annotated as body fields. Distilled Proxmox 0.3.0 fixes their query binding
+ *   and adds the measured CephFsNotFound tag. All calls now live in ceph-fs-distilled.ts;
+ *   this file keeps the pure forms, attributes and read-back failure messages. The protocol
+ *   history above remains load-bearing: moving a DELETE flag back into a body loses it silently.
  */
-import * as Effect from 'effect/Effect';
 import type { CephFsAttributes, CephFsProps } from './ceph-fs.ts';
-import { pve } from './client.ts';
-import type { PveTarget } from './credentials.ts';
 import { csv, flag, int, text } from './values.ts';
 
 /**
@@ -100,9 +92,6 @@ export const readRow = (
   };
 };
 
-/** ⚠️ `exitstatus` is ABSENT while a task runs, and is the exact string `OK` only on success. */
-type TaskStatus = { readonly status?: string; readonly exitstatus?: string };
-
 /**
  * ⚠️ SHORT POLLS, LOW CAP. Ninety seconds covers two pool creates plus the ten seconds `createfs`
  *   itself spends waiting for an MDS to go active, and is short enough that a stuck task fails the
@@ -131,83 +120,6 @@ export const createForm = (props: CephFsProps): Record<string, string> => ({
   ...field('pg_num', props.pg_num === undefined ? undefined : String(props.pg_num)),
 });
 
-/** The delete target with its flags in the query string — see the ⛔ in the header. */
-const destroyPath = (props: CephFsProps) => {
-  const query = [
-    props['remove-pools'] === true ? 'remove-pools=1' : undefined,
-    props['remove-storages'] === true ? 'remove-storages=1' : undefined,
-  ].filter((part) => part !== undefined);
-  return query.length === 0 ? objectPath(props) : `${objectPath(props)}?${query.join('&')}`;
-};
-
-/**
- * Wait for a forked PVE task, and fail loudly rather than quietly.
- *
- * ⚠️ THE UPID IS PERCENT-ENCODED BECAUSE IT IS FULL OF COLONS — `UPID:node-b:00396D3A:…:root@pam:`
- *   (MEASURED shape, from `GET /nodes/node-b/tasks`) is ONE path segment, not seven. Encoding is what
- *   guarantees it arrives as one; PVE's router decodes each segment before matching. REASONED from
- *   the URI handling rather than measured — no task of this provider's has been polled yet.
- */
-const settle = (target: PveTarget, node: string, upid: string, what: string) =>
-  Effect.gen(function* () {
-    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
-      const status = yield* pve<TaskStatus>(
-        target,
-        'read',
-        'GET',
-        `nodes/${node}/tasks/${encodeURIComponent(upid)}/status`,
-      ).pipe(
-        // ⚠️ AN UNREADABLE STATUS IS "NOT SETTLED YET", NOT A FAILURE. It is a missing Sys.Audit
-        //   (see the header) or a node mid-restart; either way the task is still the cluster's
-        //   business, and the cap is what ends the wait rather than one unlucky GET.
-        Effect.orElseSucceed(() => undefined),
-      );
-      if (status?.status === 'stopped') {
-        const exit = text(status.exitstatus);
-        if (exit === 'OK') return;
-        return yield* Effect.die(
-          new Error(
-            `${what}: PVE task ${upid} finished with "${exit === '' ? 'no exit status' : exit}". ` +
-              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +
-              `in \`pvesh get /nodes/${node}/tasks/${upid}/log\`.`,
-          ),
-        );
-      }
-      // ⚠️ A BARE NUMBER IS MILLISECONDS to Effect's Duration, not seconds. The cap in the
-      //   message below is derived from the same constant so the two cannot drift apart.
-      yield* Effect.sleep(POLL_SECONDS * 1000);
-    }
-    return yield* Effect.die(
-      new Error(
-        `${what}: PVE task ${upid} was still running after ` +
-          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its ` +
-          'status could not be read. Check the task log, and check that the `read` role holds ' +
-          `Sys.Audit on /nodes/${node} -- each call mints a new token, so the poller is never the ` +
-          'task owner and is answered 403 rather than told to wait.',
-      ),
-    );
-  });
-
-/**
- * DELETE the filesystem, then wait for the worker.
- *
- * ⛔ WHAT THIS TAKES AWAY DEPENDS ENTIRELY ON `remove-pools`, AND THE DEFAULT IS THE SAFE ONE. With
- *   it unset PVE removes the filesystem from the MDS map and LEAVES the two pools on disk: every
- *   mount breaks, but the bytes are still there for an operator to recover. With it set the pools
- *   go too and nothing is recoverable. Leaving it unset also means a later create of the SAME name
- *   fails with "ceph pools '<name>_data' and/or '<name>_metadata' already exist" -- that refusal is
- *   a BRAKE, not a bug, and it is the last thing standing between a mis-typed rename and the data.
- */
-export const destroyFs = (props: CephFsProps) =>
-  Effect.gen(function* () {
-    const upid = text(yield* pve<string>(props.target, 'provision', 'DELETE', destroyPath(props)));
-    // ⚠️ A DESTROY THAT ANSWERS WITHOUT A UPID IS NOT REFUSED HERE. `destroyfs` dies synchronously
-    //   with "no such cephfs" when the filesystem is already gone, which surfaces as a failed
-    //   DELETE; an empty answer that is not an error is best treated as already-absent, and the
-    //   caller's read-back is what proves it either way.
-    if (upid !== '') yield* settle(props.target, props.node, upid, destroyPath(props));
-  });
-
 /**
  * The two read-back failures, as messages rather than as guesses.
  *

package/src/proxmox/ceph-fs.ts

@@ -28,9 +28,9 @@
  *
  * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
  *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision
- *   43's walk-down, 2c — ceph-fs-distilled.ts). `destroyFs` STAYS on `client.ts`, unmigrated:
- *   the SDK originally put `remove-pools`/`remove-storages` in a DELETE body, which PVE ignores.
- *   SDK PR #265 fixes that protocol gap; migrating `destroyFs` remains a separate change.
+ *   43's walk-down, 2c — ceph-fs-distilled.ts). DELETE originally stayed on `client.ts`:
+ *   the SDK put its flags in a body that PVE discards (ceph-fs-wire.ts's history).
+ *   SDK 0.3.0 fixes the query binding; delete now uses it and catches only CephFsNotFound.
  *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must
  *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.
  *
@@ -67,8 +67,8 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { createFs, readFs } from './ceph-fs-distilled.ts';
-import { CEPH_FS_CREATE, createForm, destroyFs, notCreated, notDestroyed } from './ceph-fs-wire.ts';
+import { createFs, destroyFs, readFs } from './ceph-fs-distilled.ts';
+import { CEPH_FS_CREATE, createForm, notCreated, notDestroyed } from './ceph-fs-wire.ts';
 import { guardWrite } from './distilled-guard.ts';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 
@@ -222,8 +222,8 @@ export const ProxmoxCephFsProvider = () =>
          * ⛔ THE READ-BACK IS WHAT TURNS "the task said OK" INTO "it is actually gone": `destroyfs`
          *   refuses while a non-disabled `cephfs` storage still references the filesystem, and that
          *   refusal must fail the destroy rather than letting Alchemy drop the state entry for a
-         *   live object. `destroyFs` itself stays on `client.ts` — ceph-fs-wire.ts's own header has
-         *   the measured, protocol-level reason.
+         *   live object. `destroyFs` now uses the SDK query binding — ceph-fs-wire.ts preserves
+         *   the measured DELETE query-binding history.
          */
         delete: Effect.fn(function* ({ olds }) {
           /**