@homeflare/alchemy 0.41.0 → 0.42.0

package/src/proxmox/lease-cache.test.ts

@@ -14,13 +14,13 @@ import * as Cache from 'effect/Cache';
 import * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Exit from 'effect/Exit';
-import type { PveCredential } from './credentials.ts';
-import { type LeaseKey, makeLeases, timeToLive } from './lease-cache.ts';
+import { type PveCredential, type PveTarget, mintTier } from './credentials.ts';
+import { type LeaseKey, keyOf, makeLeases, targetForKey, timeToLive } from './lease-cache.ts';
 
 const C1: LeaseKey = {
   mount: 'proxmox-c1',
-  role: 'read',
   scheme: 'pve',
+  tier: 'read',
 };
 /** ⚠️ Same role as C1, DIFFERENT mount — the collision the key has to survive. */
 const C2: LeaseKey = { ...C1, mount: 'proxmox-c2' };
@@ -79,6 +79,61 @@ describe('how long a lease is kept', () => {
   });
 });
 
+describe('K-T1: keyOf resolves an overridden tier into the cache key (I1)', () => {
+  // ⛔ The one line the PR exists for (`tier: mintTier(target, role)` in `keyOf`) had no direct
+  //   test: revert it to `tier: role` and the rest of the suite still passes, because
+  //   `targetForKey`'s tests prove only the reconstruction half and `mintTier`'s tests prove only
+  //   the resolution function, never the composition a real `leased()` call depends on.
+  it('a plain PveTarget with no override keys on the bare role', () => {
+    const target: PveTarget = { members: [], mount: 'proxmox-tb4', scheme: 'pve' };
+    assert.equal(keyOf(target, 'read').tier, 'read');
+  });
+
+  it('a PveTarget.roles override reaches the cache key, not just a direct mint', () => {
+    const target: PveTarget = {
+      members: [],
+      mount: 'proxmox-tb4',
+      roles: { read: 'talos-provision' },
+      scheme: 'pve',
+    };
+    assert.equal(keyOf(target, 'read').tier, 'talos-provision');
+    // The unmentioned role still falls back to itself on the same target.
+    assert.equal(keyOf(target, 'provision').tier, 'provision');
+  });
+
+  it('a PbsTarget key never carries an override — the type has no roles field', () => {
+    const pbs = { api: 'https://pbs.invalid/api2/json', mount: 'pbs-c1', scheme: 'pbs' as const };
+    assert.equal(keyOf(pbs, 'read').tier, 'read');
+  });
+});
+
+describe('K-T1/M3: targetForKey round-trips the resolved tier back through mintTier', () => {
+  // ⛔ Since M3 dropped `role` from `LeaseKey`, `targetForKey` always mints a pve reconstruction
+  //   with the fixed role `'read'` — the caller's ORIGINAL role is irrelevant here, only `tier`
+  //   (already resolved by `keyOf`) has to round-trip.
+  it('a plain tier reconstructs to itself', () => {
+    const key: LeaseKey = { mount: 'proxmox-tb4', scheme: 'pve', tier: 'read' };
+    assert.equal(mintTier(targetForKey(key), 'read'), 'read');
+  });
+
+  it('an overridden tier reconstructs to the SAME tier, not the bare role', () => {
+    // ⛔ This is the exact reconstruction the cache-miss path depends on: `keyOf` resolved
+    //   `talos-provision` from the caller's real target once; `targetForKey` never sees that
+    //   target again, only this key, so it has to be able to rebuild the same answer from `tier`
+    //   alone.
+    const key: LeaseKey = { mount: 'proxmox-tb4', scheme: 'pve', tier: 'talos-provision' };
+    assert.equal(mintTier(targetForKey(key), 'read'), 'talos-provision');
+  });
+
+  it('a pbs key never carries an override through', () => {
+    const key: LeaseKey = { mount: 'pbs-c1', scheme: 'pbs', tier: 'provision' };
+    assert.equal(mintTier(targetForKey(key), 'provision'), 'provision');
+  });
+});
+
+// ⚠️ `mintForKey`'s own request-path behavior is exercised in lease-cache-mint.test.ts, against a
+//   fake OpenBao server — not hand-reproduced here.
+
 describe('lease cache under concurrency', () => {
   it('mints once for many concurrent callers, and serves the next from the cache', async () => {
     const mint = countingMint(() => cred('hf-read@pve!a', 3600));
@@ -123,7 +178,7 @@ describe('lease cache under concurrency', () => {
     assert.equal(mint.calls(), 2);
   });
 
-  it('does not serve one cluster the credential of another with the same mount and role', async () => {
+  it('does not serve one cluster the credential of another with the same tier', async () => {
     const mint = countingMint((call) => cred(`hf-read@pve!${String(call)}`, 3600));
     const [c1, c2] = await Effect.runPromise(
       Effect.gen(function* () {
@@ -137,8 +192,8 @@ describe('lease cache under concurrency', () => {
 
   it('shares one lease across two members of the same cluster mount', async () => {
     const mint = countingMint((call) => cred(`hf-read@pve!${String(call)}`, 3600));
-    const NODE_B: LeaseKey = { mount: 'proxmox-c1', role: 'read', scheme: 'pve' };
-    const NODE_C: LeaseKey = { mount: 'proxmox-c1', role: 'read', scheme: 'pve' };
+    const NODE_B: LeaseKey = { mount: 'proxmox-c1', scheme: 'pve', tier: 'read' };
+    const NODE_C: LeaseKey = { mount: 'proxmox-c1', scheme: 'pve', tier: 'read' };
     await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
@@ -151,7 +206,7 @@ describe('lease cache under concurrency', () => {
 
   it('keeps read and provision apart', async () => {
     const mint = countingMint((call) => cred(`hf@pve!${String(call)}`, 3600));
-    const PROVISION: LeaseKey = { ...C1, role: 'provision' };
+    const PROVISION: LeaseKey = { ...C1, tier: 'provision' };
     const [read, provision] = await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
@@ -160,4 +215,25 @@ describe('lease cache under concurrency', () => {
     );
     assert.notEqual(read.tokenId, provision.tokenId);
   });
+
+  // ⛔ K-T1's own reason `tier` joined the key: two consumers on the SAME mount/scheme but
+  //   DIFFERENT `PveTarget.roles` overrides would otherwise collide into one cache entry and hand
+  //   each other's credential to the wrong caller. M3 dropped `role` from the key entirely (it
+  //   was always redundant with `tier`), which this test still exercises unchanged.
+  it('keeps two different tier overrides of the same mount/scheme apart', async () => {
+    const mint = countingMint((call) => cred(`hf@pve!${String(call)}`, 3600));
+    const DEFAULT_READ: LeaseKey = { mount: 'proxmox-tb4', scheme: 'pve', tier: 'read' };
+    const OVERRIDDEN_READ: LeaseKey = { ...DEFAULT_READ, tier: 'talos-provision' };
+    const [plain, overridden] = await Effect.runPromise(
+      Effect.gen(function* () {
+        const leases = yield* makeLeases(mint.mintFor);
+        return [
+          yield* Cache.get(leases, DEFAULT_READ),
+          yield* Cache.get(leases, OVERRIDDEN_READ),
+        ] as const;
+      }),
+    );
+    assert.notEqual(plain.tokenId, overridden.tokenId);
+    assert.equal(mint.calls(), 2);
+  });
 });

package/src/proxmox/lease-cache.ts

@@ -47,7 +47,13 @@ import * as Cache from 'effect/Cache';
 import * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Exit from 'effect/Exit';
-import { type ApiTarget, type PveCredential, type PveRole } from './credentials.ts';
+import {
+  type ApiTarget,
+  type BaoEnvironment,
+  type PveCredential,
+  type PveRole,
+  mintTier,
+} from './credentials.ts';
 import { mint } from './mint.ts';
 
 /**
@@ -66,24 +72,49 @@ const REMINT_MARGIN_SECONDS = 60;
 /**
  * What a credential is cached under.
  *
- * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is
- *   cluster-wide — `user.cfg` is replicated — so node-b, node-c and node-d share one credential. Keying on
- *   `api` would mint three identical tokens when failover rotates members.
+ * ⛔ KEYED ON THE OPENBAO MOUNT AND TIER, NOT ON A MEMBER HOSTNAME OR ON `role` (M3, red team on
+ *   K-T1). A PVE API token is cluster-wide — `user.cfg` is replicated — so node-b, node-c and
+ *   node-d share one credential. Keying on `api` would mint three identical tokens when failover
+ *   rotates members. `role` USED to be part of this key too, but the minted credential depends
+ *   only on `(mount, scheme, tier)` — `role` only ever fed `mintTier` to re-derive the tier the
+ *   key already carries — so `roles: { read: 'x', provision: 'x' }` (one tier for both roles, the
+ *   shape `docs/credentials.md` itself recommends) used to open TWO cache entries and mint TWO
+ *   byte-for-byte interchangeable tokens for what is provably one credential. Dropping `role`
+ *   collapses that back to one entry without changing the default case, where `tier === role`
+ *   already.
  * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are
  *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.
  * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built
  *   literals with the same fields are one entry, which the probe above measured.
+ *
+ * ⛔ `tier` IS THE KEY, NOT `role` (K-T1). `targetForKey` below has to RECONSTRUCT a target from
+ *   the key alone (it does not keep the caller's original `ApiTarget` around), and a
+ *   `PveTarget.roles` override lives on THAT original target, not on `role` — so without `tier`
+ *   in the key, every `leased()` call for an overridden role would resolve its override once at
+ *   the first `keyOf`, then reuse whatever `targetForKey` happens to reconstruct on a cache miss,
+ *   and TWO DIFFERENT overrides sharing one `{mount, scheme}` (e.g. one consumer's default `read`
+ *   tier and another's `roles: {read: 'x'}` override, same mount) would collide into ONE cache
+ *   entry and hand each other's credential to the wrong caller. Resolving the tier at `keyOf` —
+ *   where the real target is still in hand — and keying on it closes that: two different tiers
+ *   are two different entries, always.
  */
 export type LeaseKey = {
   readonly mount: string;
-  readonly role: PveRole;
   readonly scheme: ApiTarget['scheme'];
+  readonly tier: string;
 };
 
-const keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({
+/**
+ * ⚠️ EXPORTED FOR THE TEST (I1, red team on K-T1). This is the one line the whole PR exists
+ *   for — `tier: mintTier(target, role)` is what makes an overridden `PveTarget.roles` reach the
+ *   cached path at all. Nothing else in this file's test suite calls `keyOf` or `leased`
+ *   directly, so without this export a regression here (e.g. reverting to `tier: role`) passed
+ *   the whole suite silently.
+ */
+export const keyOf = (target: ApiTarget, role: PveRole): LeaseKey => ({
   mount: target.mount,
-  role,
   scheme: target.scheme,
+  tier: mintTier(target, role),
 });
 
 /**
@@ -115,12 +146,45 @@ export const timeToLive = (exit: Exit.Exit<PveCredential, unknown>): Duration.Du
 export const makeLeases = <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) =>
   Cache.makeWith(mintFor, { capacity: 64, requireServicesAt: 'lookup', timeToLive });
 
-const targetForKey = (key: LeaseKey): ApiTarget =>
+/**
+ * ⛔ CARRIES `key.tier` BACK IN AS A `roles` OVERRIDE (K-T1), SO `mint`'S OWN `mintTier` CALL
+ *   REPRODUCES THE SAME TIER `keyOf` ALREADY RESOLVED. This target is synthetic — it is never the
+ *   caller's real `PveTarget` (`members`/`api` are throwaway placeholders `mint` never reads) —
+ *   and, since M3 dropped `role` from `LeaseKey`, it no longer even knows which semantic role
+ *   produced `key.tier`. It doesn't need to: `roles: { read: key.tier }` plus always minting with
+ *   the fixed role `'read'` (below) makes `mintTier(targetForKey(key), 'read') === key.tier`
+ *   unconditionally, because `mintTier` only ever consults the ONE role it's called with. Which
+ *   role the ORIGINAL caller asked for is irrelevant here — `keyOf` already folded that into
+ *   `key.tier` before this function ever sees the key.
+ * ⚠️ THE PBS BRANCH MINTS WITH `key.tier` ITSELF AS THE ROLE, NOT `'read'`. A `PbsTarget` has no
+ *   `roles` override (see `credentials.ts`'s ⛔ on `PbsTarget`), so `mintTier` for `scheme:'pbs'`
+ *   always returns its `role` argument unchanged — meaning `key.tier` for a PBS key IS the literal
+ *   role name (`'read'`/`'provision'`) `keyOf` recorded. Passing anything else here would ask
+ *   OpenBao for the wrong tier.
+ * ⚠️ EXPORTED FOR THE TEST, which checks that round trip directly rather than only through the
+ *   cache's externally visible behaviour.
+ */
+export const targetForKey = (key: LeaseKey): ApiTarget =>
   key.scheme === 'pbs'
     ? { api: 'https://pbs.invalid/api2/json', mount: key.mount, scheme: 'pbs' }
-    : { members: [], mount: key.mount, scheme: 'pve' };
+    : { members: [], mount: key.mount, roles: { read: key.tier }, scheme: 'pve' };
+
+/**
+ * ⚠️ EXPORTED FOR THE TEST (second red-team pass on K-T1). `targetForKey`'s own tests call
+ *   `mintTier(targetForKey(key), 'read')` to check the round trip, which hand-reproduces this
+ *   function's fixed choice of `'read'` as the pve mint role rather than exercising it — change
+ *   that choice here and those tests keep passing while a live cache miss mints the wrong tier.
+ *   Testing this function directly (against a fake OpenBao) pins the choice itself.
+ *
+ * ⚠️ `env` DEFAULTS TO `process.env`, SAME AS `mint` ITSELF (credentials.ts) — the cache's real
+ *   caller below (`Effect.runSync(makeLeases(mintForKey))`) always calls this with one argument,
+ *   so the default is what production runs on. The parameter exists only so the test can pass a
+ *   fake OpenBao's address without touching the real environment.
+ */
+export const mintForKey = (key: LeaseKey, env: BaoEnvironment = process.env) =>
+  mint(targetForKey(key), key.scheme === 'pbs' ? (key.tier as PveRole) : 'read', env);
 
-const leases = Effect.runSync(makeLeases((key) => mint(targetForKey(key), key.role)));
+const leases = Effect.runSync(makeLeases(mintForKey));
 
 /**
  * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when

package/src/proxmox/mint.ts

@@ -1,5 +1,5 @@
 /**
- * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<role>`, alive for five
+ * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<tier>`, alive for five
  * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the
  * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning
  * for WHY the estate mints rather than stores a token is still credentials.ts's own header.
@@ -14,6 +14,7 @@ import * as Headers from 'effect/unstable/http/Headers';
 import * as HttpClient from 'effect/unstable/http/HttpClient';
 import * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';
 import { PveCredentialDenied } from './credential-errors.ts';
+import { mintTier } from './credentials.ts';
 import type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';
 
 /** openbao v2.6.2 api/env.go:22-34 — a present BAO_* wins, even empty; else its VAULT_* twin. */
@@ -21,7 +22,9 @@ const baoVariable = (env: BaoEnvironment, name: string) =>
   env[`BAO_${name}`] ?? env[`VAULT_${name}`] ?? '';
 
 /**
- * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
+ * Mint one credential for `role`: `GET /v1/<mount>/creds/<tier>` on OpenBao's HTTP API, where
+ * `tier` is `mintTier(target, role)` (credentials.ts) — `role` itself unless `target.roles`
+ * overrides it (K-T1).
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
  *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
@@ -46,7 +49,11 @@ const baoVariable = (env: BaoEnvironment, name: string) =>
  */
 export const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = process.env) =>
   Effect.gen(function* () {
-    const path = `${target.mount}/creds/${role}`;
+    // ⛔ THE ONE PLACE A `PveRole` BECOMES A TIER NAME. `mintTier` (credentials.ts) reads
+    //   `target.roles` when the target overrides it; every other line in this function uses
+    //   `tier`, never `role`, for anything that reaches OpenBao or an error message.
+    const tier = mintTier(target, role);
+    const path = `${target.mount}/creds/${tier}`;
     // ⛔ METHOD, PATH AND OpenBao's `errors` ONLY — never a header (the token), never a success
     //   body (the credential is IN it, so echoing it would print the secret into a log).
     const refuse = (status: number, detail: string) =>
@@ -125,7 +132,7 @@ export const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = pro
        *   so it is the one signal trusted here.
        */
       if (status === 403 && isOpenBaoBody) {
-        return yield* Effect.fail(new PveCredentialDenied({ detail, mount: target.mount, role }));
+        return yield* Effect.fail(new PveCredentialDenied({ detail, mount: target.mount, tier }));
       }
       return yield* Effect.fail(refuse(status, detail || '(no errors given)'));
     }
@@ -135,7 +142,7 @@ export const mint = (target: ApiTarget, role: PveRole, env: BaoEnvironment = pro
       // ⛔ REFUSE RATHER THAN RETURN A HALF CREDENTIAL, and again WITHOUT quoting the body.
       return yield* Effect.fail(
         new Error(
-          `${target.mount}/creds/${role} returned no token_id/secret. Either this approle lacks ` +
+          `${target.mount}/creds/${tier} returned no token_id/secret. Either this approle lacks ` +
             `the grant, or the mount is not ${target.mount}. Say which mount and role you needed ` +
             `than falling back to a stored credential -- every stored PVE token is read-only.`,
         ),

package/src/proxmox/node-network.ts

@@ -94,6 +94,7 @@ import {
 } from './node-network-wire.ts';
 import type { NodeNetworkAttributes } from './node-network-wire.ts';
 import { runPve } from './distilled-pve.ts';
+import { mintTier } from './credentials.ts';
 import { type PveRequirements } from './resource-spec.ts';
 import { UNREADABLE, unreadableWarning } from './unreadable-read.ts';
 
@@ -173,7 +174,12 @@ export const ProxmoxNodeNetworkProvider = () =>
           // ⛔ THE CRIES-WOLF FIX: a refused mint used to fall into `undefined` and force `update`
           //   on an interface that was plainly there — see unreadable-read.ts.
           if (live === UNREADABLE) {
-            yield* unreadableWarning('Proxmox.NodeNetwork', `${news.node}/${news.iface}`);
+            yield* unreadableWarning(
+              'Proxmox.NodeNetwork',
+              `${news.node}/${news.iface}`,
+              news.target.mount,
+              mintTier(news.target, 'read'),
+            );
             return { action: 'noop' } as const;
           }
           if (live === undefined) {

package/src/proxmox/role.ts

@@ -64,6 +64,7 @@ import {
 } from './role-wire.ts';
 import type { PveRequirements, WithTarget } from './resource-spec.ts';
 import { runPve } from './distilled-pve.ts';
+import { mintTier } from './credentials.ts';
 import {
   UNREADABLE,
   type Unreadable,
@@ -151,7 +152,12 @@ export const ProxmoxRoleProvider = () =>
           // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force
           //   `update` on a role that was plainly there — see unreadable-read.ts.
           if (live === UNREADABLE) {
-            yield* unreadableWarning('Proxmox.Role', news.roleid);
+            yield* unreadableWarning(
+              'Proxmox.Role',
+              news.roleid,
+              news.target.mount,
+              mintTier(news.target, 'read'),
+            );
             return { action: 'noop' } as const;
           }
           if (live === undefined) {

package/src/proxmox/storage.ts

@@ -86,6 +86,7 @@ import {
   updateForm,
 } from './storage-form.ts';
 import { dropUnreadable, matches, readStorage, readStorageOrFail } from './storage-wire.ts';
+import { mintTier } from './credentials.ts';
 import { UNREADABLE, unreadableWarning } from './unreadable-read.ts';
 import type { StorageAttributes } from './storage-wire.ts';
 import type { StorageLocator } from './storage-form.ts';
@@ -182,7 +183,12 @@ export const ProxmoxStorageProvider = () =>
           // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force
           //   `update` on a storage that was plainly there — see unreadable-read.ts.
           if (live === UNREADABLE) {
-            yield* unreadableWarning('Proxmox.Storage', news.storage);
+            yield* unreadableWarning(
+              'Proxmox.Storage',
+              news.storage,
+              news.target.mount,
+              mintTier(news.target, 'provision'),
+            );
             return { action: 'noop' } as const;
           }
           if (live === undefined) {

package/src/proxmox/unreadable-read.ts

@@ -51,10 +51,22 @@ export const readOrUnreadable = <A, E, R>(
  * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has
  * nowhere to carry the distinction through to the printed action. See the header for why a log
  * line, not a failed diff or a fourth Diff action, is what "the plan reports" means here.
+ *
+ * ⛔ M6 (Opus red team, K-T1): NAMES `mount` AND `tier`, NOT JUST THE RESOURCE. Before this, the
+ *   line read "no grant for this credential's role" with nothing to act on — an operator debugging
+ *   a scoped-down `PveTarget.roles` override (the whole point of K-T1) had to go re-derive which
+ *   mount and tier the read actually asked OpenBao for before they could even open that mount's
+ *   policy. `PveCredentialDenied`'s own message already made this exact call — reading `tier`, not
+ *   `role`, per that class's own ⛔ — so this warning takes the same two fields for the same reason.
  */
-export const unreadableWarning = (type: string, identity: string): Effect.Effect<void> =>
+export const unreadableWarning = (
+  type: string,
+  identity: string,
+  mount: string,
+  tier: string,
+): Effect.Effect<void> =>
   Effect.logWarning(
-    `${type} ${identity}: the read was refused (no grant for this credential's role) -- ` +
-      'reporting noop rather than forcing an update with nothing compared. Re-plan on a lane ' +
-      'that can read this object before trusting this row.',
+    `${type} ${identity}: the read of ${mount}/creds/${tier} was refused (no grant for this ` +
+      "credential's role) -- reporting noop rather than forcing an update with nothing compared. " +
+      'Re-plan on a lane that can read this object before trusting this row.',
   );

package/src/proxmox/user.ts

@@ -60,6 +60,7 @@ import * as Effect from 'effect/Effect';
 import { guardWrite } from './distilled-guard.ts';
 import type { PveRequirements, WithTarget } from './resource-spec.ts';
 import { runPve } from './distilled-pve.ts';
+import { mintTier } from './credentials.ts';
 import { UNREADABLE, unreadableWarning } from './unreadable-read.ts';
 import {
   USER_CREATE,
@@ -162,7 +163,12 @@ export const ProxmoxUserProvider = () =>
           // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force
           //   `update` on an account that was plainly there — see unreadable-read.ts.
           if (live === UNREADABLE) {
-            yield* unreadableWarning('Proxmox.User', news.userid);
+            yield* unreadableWarning(
+              'Proxmox.User',
+              news.userid,
+              news.target.mount,
+              mintTier(news.target, 'read'),
+            );
             return { action: 'noop' } as const;
           }
           if (live === undefined) {

package/src/proxmox/zfs-pool.ts

@@ -78,6 +78,7 @@ import * as Effect from 'effect/Effect';
 import { asForm } from './distilled-guard.ts';
 import { guardForm } from './constraint-guard.ts';
 import type { PveRequirements, WithTarget } from './resource-spec.ts';
+import { mintTier } from './credentials.ts';
 import { UNREADABLE, unreadableWarning } from './unreadable-read.ts';
 import { dropUnreadable, readPool, readPoolOrFail } from './zfs-pool-wire.ts';
 import type { ZfsPoolAttributes } from './zfs-pool-wire.ts';
@@ -202,7 +203,12 @@ export const ProxmoxZfsPoolProvider = () =>
           //   update, the cries-wolf class of bug.
           const live = yield* readPoolOrFail(news);
           if (live === UNREADABLE) {
-            yield* unreadableWarning('Proxmox.ZfsPool', `${news.node}/${news.name}`);
+            yield* unreadableWarning(
+              'Proxmox.ZfsPool',
+              `${news.node}/${news.name}`,
+              news.target.mount,
+              mintTier(news.target, 'read'),
+            );
             return { action: 'noop' } as const;
           }
           // ⛔ FOUND WRITING THIS FILE, 2026-09-24 — an earlier edit that removed the dead