@homeflare/alchemy 0.45.0 → 0.46.0

package/src/proxmox/qemu-dns.ts

@@ -0,0 +1,32 @@
+/** Cloud-init's one named format, checked against the vendor table and validator source. */
+import { isIP } from 'node:net';
+import { constraintsFor } from './constraint-guard.ts';
+
+/**
+ * PVE::JSONSchema pve_verify_address/check_format and PVE::ParseUtils split_list,
+ * proxmox/pve-common@defd246f31f327463f901a2daaf8dc52efcc5a97 (read 2026-10-05).
+ * https://github.com/proxmox/pve-common/blob/defd246f31f327463f901a2daaf8dc52efcc5a97/src/PVE/JSONSchema.pm
+ * ★ `address` permits DNS names too; an IP-only check would reject vendor-valid declarations.
+ * Empty lists are allowed. NUL-separated lists take precedence over whitespace/comma/semicolon.
+ * This supplements the PVE 9.2.11 schema's named format; it does not invent a DNS-server limit.
+ */
+const addressList = (value: string): boolean => {
+  const values = value.includes('\0')
+    ? value.split('\0')
+    : value.replace(/[,;]/g, ' ').trimStart().split(/\s+/);
+  // Perl split drops trailing empty elements, but retains interior empty elements.
+  while (values.at(-1) === '') values.pop();
+  const label = '[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?';
+  const dns = new RegExp(`^(?:${label}\\.)*${label}(?![\\s\\S])`);
+  return values.every((value) => (isIP(value) !== 0 && !value.includes('%')) || dns.test(value));
+};
+
+export const dnsRefusals = (nameserver: unknown): string[] => {
+  if (nameserver === undefined) return [];
+  const rule = constraintsFor('pve:PUT /nodes/{node}/qemu/{vmid}/config')['nameserver'];
+  return rule?.format === 'address-list' &&
+    typeof nameserver === 'string' &&
+    addressList(nameserver)
+    ? []
+    : ['nameserver: must satisfy the vendor address-list format'];
+};

package/src/proxmox/qemu-errors.ts

@@ -1,5 +1,6 @@
 /** A QEMU write or observation this provider will not turn into a create or a delete. */
 export class QemuRefusedError extends Error {
+  readonly _tag = 'QemuRefusedError';
   constructor(message: string) {
     super(message);
     this.name = 'QemuRefusedError';

package/src/proxmox/qemu-form.ts

@@ -13,16 +13,19 @@ import {
   isManagedKey,
   wireValue,
 } from './qemu-props.ts';
+import { dnsRefusals } from './qemu-dns.ts';
 
 /**
  * Why a declared key cannot go on the wire, checked before every create and every update.
  * ★ THE SAME RULE `lxc-create-form.ts` ENFORCES FOR `Proxmox.Lxc`: a key smuggled past the types
  *   (a cast, a JS caller) is refused here rather than silently dropped or silently sent.
  */
-export const formRefusals = (props: VmProps): string[] =>
-  declaredKeys(props)
+export const formRefusals = (props: VmProps): string[] => [
+  ...declaredKeys(props)
     .filter((key) => !isManagedKey(key))
-    .map((key) => `${key}: not a config key this resource manages (vmid ${String(props.vmid)}).`);
+    .map((key) => `${key}: not a config key this resource manages (vmid ${String(props.vmid)}).`),
+  ...dnsRefusals(props.nameserver),
+];
 
 /** The declared config, wire-spelled — every key `formRefusals` did not already refuse. */
 export const form = (props: VmProps): Record<string, string> => {

package/src/proxmox/qemu-judge.ts

@@ -13,6 +13,7 @@
 import { type VmProps, declaredKeys, declaredValue, indexedKey, wireValue } from './qemu-props.ts';
 import { judgeDisk } from './qemu-volume.ts';
 import { netWrite, sameNet } from './qemu-net.ts';
+import { diskSizeDrift } from './qemu-size.ts';
 
 export type VmChange = {
   /** Keys to `PUT …/config`, wire-spelled and built on live ids where one exists. */
@@ -26,7 +27,7 @@ export type VmChange = {
 export const judge = (props: VmProps, config: Record<string, string>): VmChange => {
   const put: Record<string, string> = {};
   const refuse: string[] = [];
-  const drift = new Set<string>();
+  const drift = new Set<string>(diskSizeDrift(props, config));
 
   for (const key of declaredKeys(props)) {
     const want = wireValue(declaredValue(props, key));

package/src/proxmox/qemu-lifecycle.ts

@@ -15,59 +15,29 @@ import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
 import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { runPve } from './distilled-pve.ts';
-import { createForm, formRefusals, updateForm } from './qemu-form.ts';
+import { createForm, formRefusals } from './qemu-form.ts';
 import { QemuRefusedError } from './qemu-errors.ts';
 import { identityRefusal, judge } from './qemu-judge.ts';
-import {
-  type VmAttributes,
-  type VmProps,
-  declaredKeys,
-  declaredValue,
-  isManagedKey,
-  storedConfig,
-  wireValue,
-} from './qemu-props.ts';
+import type { VmAttributes, VmProps } from './qemu-props.ts';
 import { readVm } from './qemu-read.ts';
 import { qemuTask } from './qemu-task.ts';
-import type { PveSpec } from './resource-spec.ts';
-import { specGuards } from './resource-guard.ts';
+import { attributesOf, guardCreate, guardUpdate, spec } from './qemu-spec.ts';
+import { type QemuDiskResizeRefused, checkLiveDiskSizes, validateDiskSizes } from './qemu-size.ts';
+import { resizeDisks } from './qemu-resize.ts';
 
 const CREATE_POLLS = 180;
 const DELETE_POLLS = 60;
 
-const attributesOf = (live: Record<string, unknown>, props: VmProps): VmAttributes => ({
-  config: storedConfig(live),
-  node: props.node,
-  vmid: props.vmid,
-});
-
-/**
- * ⚠️ KEPT ONLY TO SATISFY `PveSpec`'S REQUIRED FIELD — `qemu-judge.ts`'s `judge` is what diff and
- *   reconcile actually decide by, since a plain string compare is exactly the bug C1 found (it
- *   never matches the "new disk" or MAC-less spellings a declaration may use).
- */
-const matches = (attributes: VmAttributes, props: VmProps) =>
-  declaredKeys(props)
-    .filter(isManagedKey)
-    .every((key) => attributes.config[key] === wireValue(declaredValue(props, key)));
-
-const spec = {
-  attributes: attributesOf,
-  collection: (props: VmProps) => `nodes/${props.node}/qemu`,
-  createForm,
-  endpoint: {
-    create: 'pve:POST /nodes/{node}/qemu',
-    update: 'pve:PUT /nodes/{node}/qemu/{vmid}/config',
-  },
-  matches,
-  path: (props: VmProps) => `nodes/${props.node}/qemu/${String(props.vmid)}/config`,
-  updateForm,
-} satisfies PveSpec<VmProps, VmAttributes>;
-
-const { guardCreate, guardUpdate } = specGuards(spec);
+// ★ mint's legacy Error must not erase these tags from the inferred union (distilled-pve.ts).
+type QemuLifecycleError =
+  | Effect.Error<ReturnType<typeof readQemu>>
+  | nodes.PutNodeQemuResizeError
+  | QemuRefusedError
+  | QemuDiskResizeRefused;
 
 export const readQemu = (props: VmProps) =>
   readVm(props).pipe(
@@ -115,8 +85,8 @@ export const qemuHandlers = {
   /**
    * ⛔ `Unowned` UNLESS STATE ALREADY VOUCHES FOR IT (C2). With no attributes this is Alchemy's
    *   adoption probe or the recovery read for an interrupted create (ownership/probe.ts); `settled`
-   *   is the same `judge` reconcile uses, so "proven ours" and "reconcile would write nothing" are
-   *   the same question asked once.
+   *   uses the same config comparison as reconcile. Disk growth is a post-create step, so its
+   *   drift cannot disown a VM after an interrupted/failed resize (measured 2026-10-05).
    */
   read: Effect.fn(function* ({
     fqn,
@@ -131,7 +101,9 @@ export const qemuHandlers = {
   }) {
     const found = yield* readQemu(olds);
     const settled = Effect.sync(
-      () => found !== undefined && judge(olds, found.config).drift.length === 0,
+      () =>
+        found !== undefined &&
+        judge(olds, found.config).drift.every((key) => key.startsWith('diskSizesGiB.')),
     );
     return yield* ownedRead({ fqn, instanceId, output }, found, settled);
   }),
@@ -143,11 +115,16 @@ export const qemuHandlers = {
     news: Input<VmProps>;
     olds: VmProps;
     output: VmAttributes | undefined;
-  }) {
+  }): Effect.fn.Return<
+    { readonly action: 'noop' | 'update' } | undefined,
+    QemuLifecycleError,
+    HttpClient.HttpClient
+  > {
     if (!isResolved(news)) return undefined;
     const identity = identityRefusal(news.vmid, output?.vmid ?? olds.vmid);
     if (identity !== undefined) return yield* Effect.fail(new QemuRefusedError(identity));
     yield* refuseUnmanaged(news);
+    yield* validateDiskSizes(news, olds);
     yield* guardCreate(news, output === undefined);
     yield* guardUpdate(news);
     if (output === undefined) return undefined;
@@ -162,6 +139,7 @@ export const qemuHandlers = {
       yield* guardCreate(news, true);
       return { action: 'update' } as const;
     }
+    yield* checkLiveDiskSizes(news, live.config, true);
     const change = judge(news, live.config);
     yield* refuseChange(change);
     return { action: change.drift.length === 0 ? 'noop' : 'update' } as const;
@@ -178,10 +156,11 @@ export const qemuHandlers = {
     news: VmProps;
     olds: VmProps | undefined;
     output: VmAttributes | undefined;
-  }) {
+  }): Effect.fn.Return<VmAttributes, QemuLifecycleError, HttpClient.HttpClient> {
     const identity = identityRefusal(news.vmid, output?.vmid ?? olds?.vmid);
     if (identity !== undefined) return yield* Effect.fail(new QemuRefusedError(identity));
     yield* refuseUnmanaged(news);
+    yield* validateDiskSizes(news, olds);
     const live = yield* readQemu(news);
     yield* guardCreate(news, live === undefined);
     yield* guardUpdate(news);
@@ -199,6 +178,7 @@ export const qemuHandlers = {
         { fqn, instanceId, output },
         `Proxmox.Vm VM ${String(news.vmid)} on ${news.node}`,
       );
+      yield* checkLiveDiskSizes(news, live.config, true);
       const change = judge(news, live.config);
       yield* refuseChange(change);
       if (Object.keys(change.put).length > 0) {
@@ -210,6 +190,7 @@ export const qemuHandlers = {
         );
       }
     }
+    yield* resizeDisks(news);
     const after = yield* readQemu(news);
     if (after === undefined) {
       return yield* Effect.fail(

package/src/proxmox/qemu-props.ts

@@ -48,6 +48,16 @@ export interface VmProps extends WithTarget {
   boot?: string;
   /** e.g. `virtio-scsi-single`. */
   scsihw?: string;
+  /** Cloud-init DNS servers: PVE's `address-list` (IP addresses or DNS names). */
+  nameserver?: string;
+  /** Cloud-init DNS search domains, in PVE's wire spelling. */
+  searchdomain?: string;
+  /**
+   * Minimum disk sizes in GiB, e.g. `{ scsi0: 64 }`, grown after import completes.
+   * Existing larger disks are left alone. Lowering a previously declared target is refused.
+   * These are resize targets, never config fields; declare the corresponding disk slot too.
+   */
+  diskSizesGiB?: Partial<Record<`scsi${number}` | `ide${number}`, number>>;
   /**
    * `local-zfs:32` to create a new volume, or the live volume string as adopted —
    * `cephtb4:vm-101-disk-0,size=32G` (n is 0 to 30, pve-qemu-server's own `$MAX_SCSI_DISKS`).
@@ -81,8 +91,8 @@ export interface VmAttributes {
   config: Record<string, string>;
 }
 
-/** Props that identify the object rather than configure it: never sent, never compared. */
-const NOT_CONFIG: ReadonlySet<string> = new Set(['node', 'target', 'vmid']);
+/** Identity and resize metadata: never config form fields; sizes are compared separately. */
+const NOT_CONFIG: ReadonlySet<string> = new Set(['node', 'target', 'vmid', 'diskSizesGiB']);
 
 /** The indexed families this resource manages, with pve-qemu-server's own published range. */
 export const INDEXED = {
@@ -111,8 +121,10 @@ const SCALAR_KEYS: ReadonlySet<string> = new Set([
   'cpu',
   'memory',
   'name',
+  'nameserver',
   'onboot',
   'scsihw',
+  'searchdomain',
   'sockets',
 ]);
 

package/src/proxmox/qemu-resize-lock.test.ts

@@ -0,0 +1,121 @@
+/** Raw locks survive the SDK even though stored attributes omit them. All waits use TestClock. */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Fiber from 'effect/Fiber';
+import * as TestClock from 'effect/testing/TestClock';
+import { FAKE_TARGET, fakePve, withoutBao } from './fake-pve.ts';
+import { qemuHandlers } from './qemu-lifecycle.ts';
+import { resizeDisks } from './qemu-resize.ts';
+
+const props = {
+  target: FAKE_TARGET,
+  node: 'n2',
+  vmid: 10000,
+  scsi0: 'cephtb4:0,import-from=cephfs-tb4:import/talos.raw',
+  diskSizesGiB: { scsi0: 64 },
+};
+const path = 'nodes/n2/qemu/10000';
+const resizeTask = 'UPID:n2:2:0:0:qmresize:10000:test@pve!fake:';
+const config = (size: string) => ({
+  digest: 'a'.repeat(40),
+  scsi0: `cephtb4:vm-10000-disk-0,size=${size}`,
+});
+const output = { ...props, config: config('4.15G') };
+
+test('backup-locked disks at or above target need one read, no wait and no write', async () => {
+  const fake = fakePve((call) => {
+    expect(call.path).toBe(`${path}/config`);
+    return {
+      ...config('64G'),
+      scsi1: 'cephtb4:vm-10000-disk-1,size=128G',
+      lock: 'backup',
+    };
+  });
+  await withoutBao(() =>
+    Effect.runPromise(
+      Effect.gen(function* () {
+        // No clock adjustment: any lock sleep would leave this operation suspended.
+        yield* resizeDisks({
+          ...props,
+          scsi1: 'cephtb4:vm-10000-disk-1',
+          diskSizesGiB: { scsi0: 64, scsi1: 64 },
+        });
+      }).pipe(Effect.provide(fake.layer), Effect.provide(TestClock.layer())),
+    ),
+  );
+  expect(fake.calls).toHaveLength(1);
+  expect(fake.writes()).toEqual([]);
+});
+
+for (const lockState of ['persists', 'clears', 'clears-at-target', 'task-timeout'] as const) {
+  test(`resize observes import lock: ${lockState}`, async () => {
+    let reads = 0;
+    let polls = 0;
+    let resized = false;
+    let locked = true;
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/')) {
+        polls++;
+        if (lockState === 'task-timeout') return { status: 'running' };
+        resized = true;
+        return { status: 'stopped', exitstatus: 'OK' };
+      }
+      if (call.path === `${path}/config`) {
+        reads++;
+        // Reconcile and the size precheck precede the three raw resize lock checks.
+        locked = lockState === 'persists' || reads <= 5;
+        return {
+          ...config(resized || (!locked && lockState === 'clears-at-target') ? '64G' : '4.15G'),
+          ...(locked ? { lock: lockState === 'persists' ? 'backup' : 'create' } : {}),
+        };
+      }
+      if (call.path === `${path}/resize`) {
+        expect(locked).toBe(false);
+        expect(call.form).toEqual({ disk: 'scsi0', size: '64G' });
+        return resizeTask;
+      }
+      throw new Error(`unexpected ${call.method} ${call.path}`);
+    });
+    const result = await withoutBao(() =>
+      Effect.runPromise(
+        Effect.gen(function* () {
+          const worker = yield* qemuHandlers
+            .reconcile({
+              fqn: 'row',
+              instanceId: 'row',
+              news: props,
+              olds: props,
+              output,
+            })
+            .pipe(
+              Effect.catchTag('QemuDiskResizeRefused', (error) => Effect.succeed(error)),
+              Effect.catchTag('QemuRefusedError', (error) => Effect.succeed(error)),
+              Effect.provide(fake.layer),
+              Effect.forkChild,
+            );
+          while (reads < 2) yield* Effect.yieldNow;
+          yield* TestClock.adjust('61 seconds');
+          return yield* Fiber.join(worker);
+        }).pipe(Effect.provide(TestClock.layer())),
+      ),
+    );
+    if (lockState === 'persists') {
+      expect(result).toMatchObject({
+        _tag: 'QemuDiskResizeRefused',
+        disk: 'scsi0',
+        message: 'scsi0: VM 10000 remains locked (backup) after 60 observations; refusing resize',
+      });
+      expect(reads).toBe(62);
+      expect(polls).toBe(0);
+    } else if (lockState === 'task-timeout') {
+      expect(result).toMatchObject({ _tag: 'QemuRefusedError' });
+      expect(polls).toBe(57); // Three lock waits leave 57 task observations, not a new budget.
+    } else {
+      expect(result).toMatchObject({ config: { scsi0: config('64G').scsi0 } });
+      expect(polls).toBe(lockState === 'clears' ? 1 : 0);
+    }
+    expect(fake.writes()).toEqual(
+      lockState === 'persists' || lockState === 'clears-at-target' ? [] : [`PUT ${path}/resize`],
+    );
+  });
+}

package/src/proxmox/qemu-resize-recovery.test.ts

@@ -0,0 +1,81 @@
+/** Failed creates resume through Alchemy's real state recovery, with adoption disabled. */
+import { expect, test } from 'bun:test';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET, fakePve, withoutBao } from './fake-pve.ts';
+import { ProxmoxVm, ProxmoxVmProvider } from './qemu.ts';
+
+const props = {
+  target: FAKE_TARGET,
+  node: 'n2',
+  vmid: 10000,
+  name: 'talos',
+  scsi0: 'cephtb4:0,import-from=cephfs-tb4:import/talos.raw',
+  diskSizesGiB: { scsi0: 64 },
+};
+const path = 'nodes/n2/qemu/10000';
+const importTask = 'UPID:n2:1:0:0:qmcreate:10000:test@pve!fake:';
+const resizeTask = 'UPID:n2:2:0:0:qmresize:10000:test@pve!fake:';
+
+for (const otherDrift of [false, true]) {
+  test(`failed resize recovery without adoption (other config drift: ${otherDrift})`, async () => {
+    let created = false;
+    let resized = false;
+    let attempts = 0;
+    let name = props.name;
+    const fake = fakePve((call) => {
+      if (call.path.startsWith('cluster/resources')) return [];
+      if (call.path.includes(encodeURIComponent(importTask)))
+        return { status: 'stopped', exitstatus: 'OK' };
+      if (call.path.includes(encodeURIComponent(resizeTask))) {
+        resized = attempts > 1;
+        return { status: 'stopped', exitstatus: resized ? 'OK' : 'disk resize failed' };
+      }
+      if (call.path === `${path}/config`)
+        return created
+          ? {
+              digest: 'a'.repeat(40),
+              name,
+              scsi0: `cephtb4:vm-10000-disk-0,size=${resized ? '64G' : '4.15G'}`,
+            }
+          : Response.json(
+              {
+                data: null,
+                message: "Configuration file 'nodes/n2/qemu-server/10000.conf' does not exist\n",
+              },
+              { status: 500 },
+            );
+      if (call.method === 'POST') {
+        created = true;
+        return importTask;
+      }
+      if (call.path === `${path}/resize`) {
+        attempts++;
+        return resizeTask;
+      }
+      throw new Error(`unexpected ${call.method} ${call.path}`);
+    });
+    await withoutBao(async () => {
+      const stack = engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)), {
+        adopt: false,
+      });
+      await expect(stack.deploy(ProxmoxVm('row', props))).rejects.toThrow(/disk resize failed/);
+      if (otherDrift) {
+        name = 'someone-else';
+        await expect(stack.deploy(ProxmoxVm('row', props))).rejects.toThrow(/adopt/i);
+      } else {
+        await stack.deploy(ProxmoxVm('row', props));
+        await stack.deploy(ProxmoxVm('row', props));
+        expect(resized).toBe(true);
+        expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+          diff: 'noop',
+        });
+      }
+    });
+    expect(fake.writes()).toEqual([
+      'POST nodes/n2/qemu',
+      `PUT ${path}/resize`,
+      ...(otherDrift ? [] : [`PUT ${path}/resize`]),
+    ]);
+  });
+}

package/src/proxmox/qemu-resize.test.ts

@@ -0,0 +1,199 @@
+/** Real SDK and Alchemy engine, fake PVE only: imports must finish before resize or power-on. */
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET, fakePve, withoutBao } from './fake-pve.ts';
+import { qemuHandlers } from './qemu-lifecycle.ts';
+import { ProxmoxVm, ProxmoxVmProvider } from './qemu.ts';
+
+const base = { target: FAKE_TARGET, node: 'n2', vmid: 10000 };
+const props = {
+  ...base,
+  scsi0: 'cephtb4:0,import-from=cephfs-tb4:import/talos.raw',
+  diskSizesGiB: { scsi0: 64 },
+};
+const path = 'nodes/n2/qemu/10000';
+const importTask = 'UPID:n2:1:0:0:qmcreate:10000:test@pve!fake:';
+const resizeTask = 'UPID:n2:2:0:0:qmresize:10000:test@pve!fake:';
+const config = (size: string) => ({
+  digest: 'a'.repeat(40),
+  scsi0: `cephtb4:vm-10000-disk-0,size=${size}`,
+});
+const output = { ...base, config: config('4.15G') };
+const missing = () =>
+  Response.json(
+    {
+      data: null,
+      message: "Configuration file 'nodes/n2/qemu-server/10000.conf' does not exist\n",
+    },
+    { status: 500 },
+  );
+
+test('import completes, allocated size is read, resize completes, then reconciliation returns', async () => {
+  let created = false;
+  let imported = false;
+  let resized = false;
+  const fake = fakePve((call) => {
+    if (call.path.startsWith('cluster/resources')) return [];
+    if (call.path.includes(encodeURIComponent(importTask))) {
+      imported = true;
+      return { status: 'stopped', exitstatus: 'OK' };
+    }
+    if (call.path.includes(encodeURIComponent(resizeTask))) {
+      resized = true;
+      return { status: 'stopped', exitstatus: 'OK' };
+    }
+    if (call.path === `${path}/config`)
+      return created ? config(resized ? '64G' : '4.15G') : missing();
+    if (call.method === 'POST') {
+      expect(call.form['diskSizesGiB']).toBeUndefined();
+      expect(call.form['start']).toBeUndefined();
+      expect(call.form['scsi0']).toBe(props.scsi0);
+      created = true;
+      return importTask;
+    }
+    if (call.path === `${path}/resize`) {
+      expect(imported).toBe(true);
+      expect(call.form).toEqual({ disk: 'scsi0', size: '64G' });
+      return resizeTask;
+    }
+    throw new Error(`unexpected ${call.method} ${call.path}`);
+  });
+  await withoutBao(async () => {
+    const stack = engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)));
+    await stack.deploy(ProxmoxVm('row', props));
+    expect(resized).toBe(true); // The caller's separate power-on step can proceed only now.
+    await stack.deploy(ProxmoxVm('row', props));
+    expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+      diff: 'noop',
+    });
+  });
+  expect(fake.writes()).toEqual(['POST nodes/n2/qemu', `PUT ${path}/resize`]);
+  const resizeIndex = fake.calls.findIndex((call) => call.path === `${path}/resize`);
+  expect(fake.calls[resizeIndex - 1]?.path).toBe(`${path}/config`);
+});
+
+for (const initialSize of ['4250M', '63.9999999990687G']) {
+  test(`recovery of an imported disk at ${initialSize} grows once without re-importing`, async () => {
+    let size = initialSize;
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/')) {
+        size = '64G';
+        return { status: 'stopped', exitstatus: 'OK' };
+      }
+      if (call.method === 'GET') return config(size);
+      if (call.path === `${path}/resize`) return resizeTask;
+      throw new Error('must not re-import');
+    });
+    await withoutBao(async () => {
+      const stack = engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)));
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'update',
+      });
+      await stack.deploy(ProxmoxVm('row', props));
+      await stack.deploy(ProxmoxVm('row', props));
+    });
+    expect(fake.writes()).toEqual([`PUT ${path}/resize`]);
+  });
+}
+
+test('equal and larger live disks are no-ops, including equivalent units', async () => {
+  for (const size of ['64G', '65536M', '128G', '1T', '64.0000000009313G']) {
+    const fake = fakePve(() => config(size));
+    await withoutBao(async () => {
+      const stack = engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)));
+      await stack.deploy(ProxmoxVm('row', props));
+      expect((await stack.verify(ProxmoxVm('row', props), { all: true })).rows[0]).toMatchObject({
+        diff: 'noop',
+      });
+    });
+    expect(fake.writes()).toEqual([]);
+  }
+});
+
+test('a declared decrease is catchTag-able and refuses both diff and reconcile before writes', async () => {
+  const fake = fakePve(() => config('64G'));
+  const news = { ...props, diskSizesGiB: { scsi0: 32 } };
+  await withoutBao(async () => {
+    for (const operation of [
+      qemuHandlers.diff({ news, olds: props, output }).pipe(Effect.asVoid),
+      qemuHandlers
+        .reconcile({ fqn: 'row', instanceId: 'row', news, olds: props, output })
+        .pipe(Effect.asVoid),
+    ]) {
+      const result = await Effect.runPromise(
+        operation.pipe(
+          Effect.catchTag('QemuDiskResizeRefused', (error) => Effect.succeed(error.message)),
+          Effect.provide(fake.layer),
+        ),
+      );
+      expect(result).toContain('refusing shrink');
+    }
+  });
+  expect(fake.calls).toEqual([]);
+});
+
+test('failed resize tasks and false success never claim the target was reached', async () => {
+  for (const exitstatus of ['disk resize failed', 'OK']) {
+    const fake = fakePve((call) => {
+      if (call.path.includes('/tasks/')) return { status: 'stopped', exitstatus };
+      if (call.method === 'GET') return config('4.15G');
+      return resizeTask;
+    });
+    await withoutBao(async () => {
+      const stack = engineOver(ProxmoxVmProvider().pipe(Layer.provideMerge(fake.layer)));
+      await expect(stack.deploy(ProxmoxVm('row', props))).rejects.toThrow(
+        exitstatus === 'OK' ? /diskSizesGiB.scsi0 still differ/ : /disk resize failed/,
+      );
+    });
+    expect(fake.writes()).toEqual([`PUT ${path}/resize`]);
+  }
+});
+
+test('unreadable live capacity blocks unrelated config writes too', async () => {
+  const fake = fakePve(() => config('unknown'));
+  await withoutBao(async () => {
+    const result = await Effect.runPromise(
+      qemuHandlers
+        .diff({
+          news: { ...props, memory: 8192 },
+          olds: props,
+          output,
+        })
+        .pipe(
+          Effect.catchTag('QemuDiskResizeRefused', (error) => Effect.succeed(error._tag)),
+          Effect.provide(fake.layer),
+        ),
+    );
+    expect(result).toBe('QemuDiskResizeRefused');
+  });
+  expect(fake.writes()).toEqual([]);
+});
+
+test('SDK resize failures preserve generated tags and never start a task or retry a write', async () => {
+  const fake = fakePve((call) =>
+    call.method === 'GET'
+      ? config('4.15G')
+      : Response.json({ data: null, message: 'permission denied' }, { status: 403 }),
+  );
+  await withoutBao(async () => {
+    const result = await Effect.runPromise(
+      qemuHandlers
+        .reconcile({
+          fqn: 'row',
+          instanceId: 'row',
+          news: props,
+          olds: props,
+          output,
+        })
+        .pipe(
+          Effect.catchTag('Forbidden', (error) => Effect.succeed(error._tag)),
+          Effect.provide(fake.layer),
+        ),
+    );
+    expect(result).toBe('Forbidden');
+  });
+  expect(fake.writes()).toEqual([`PUT ${path}/resize`]);
+  expect(fake.calls.some((call) => call.path.includes('/tasks/'))).toBe(false);
+});