@celilo/cli 0.16.2 → 0.18.0

package/src/services/audit/abandoned-operations.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, it } from 'bun:test';
+import {
+  ABANDONED_THRESHOLD,
+  ABANDONED_WINDOW_MS,
+  type AbandonedOperationRecord,
+  auditAbandonedOperations,
+} from './abandoned-operations';
+
+const NOW = Date.parse('2026-08-05T12:00:00Z');
+const now = () => NOW;
+
+function records(
+  moduleId: string,
+  operation: 'deploy' | 'backup',
+  count: number,
+  ageMs = 60_000,
+): AbandonedOperationRecord[] {
+  return Array.from({ length: count }, () => ({
+    moduleId,
+    operation,
+    startedAt: NOW - ageMs,
+  }));
+}
+
+describe('auditAbandonedOperations', () => {
+  it('says nothing about a single abandonment — that is an operator hitting Ctrl-C', () => {
+    const findings = auditAbandonedOperations({
+      records: records('forgejo', 'backup', ABANDONED_THRESHOLD - 1),
+      now,
+    });
+    expect(findings).toEqual([]);
+  });
+
+  it('flags a module whose same operation keeps dying', () => {
+    const findings = auditAbandonedOperations({
+      records: records('forgejo', 'backup', 63),
+      now,
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.subject).toBe('forgejo');
+    expect(findings[0]?.severity).toBe('drift');
+    expect(findings[0]?.message).toContain('63 backup operations abandoned');
+  });
+
+  // The point of grouping: a module whose backups are being killed and whose
+  // deploys are fine should say exactly that.
+  it('reports each operation kind separately', () => {
+    const findings = auditAbandonedOperations({
+      records: [...records('forgejo', 'backup', 5), ...records('technitium', 'deploy', 5)],
+      now,
+    });
+
+    expect(findings.map((f) => f.subject)).toEqual(['forgejo', 'technitium']);
+    expect(findings[1]?.message).toContain('deploy operations');
+  });
+
+  it('ignores abandonments older than the window, so a fixed module stops being flagged', () => {
+    const findings = auditAbandonedOperations({
+      records: records('forgejo', 'backup', 60, ABANDONED_WINDOW_MS + 60_000),
+      now,
+    });
+    expect(findings).toEqual([]);
+  });
+
+  it('does not merge two modules into one unactionable count', () => {
+    const findings = auditAbandonedOperations({
+      records: [...records('forgejo', 'backup', 2), ...records('lunacycle', 'backup', 2)],
+      now,
+    });
+    expect(findings).toEqual([]);
+  });
+});

package/src/services/audit/disk-space.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, test } from 'bun:test';
+import {
+  DISK_BLOCKED_PERCENT,
+  DISK_DRIFT_PERCENT,
+  type DiskUsageResult,
+  auditDiskSpace,
+} from './disk-space';
+
+function usage(over: Partial<DiskUsageResult> = {}): DiskUsageResult {
+  return {
+    hostname: 'celilo-mgr',
+    ipAddress: '10.0.120.10',
+    usedPercent: 10,
+    availableBytes: 102 * 1024 ** 3,
+    ...over,
+  };
+}
+
+describe('auditDiskSpace', () => {
+  test('a healthy filesystem produces no finding', () => {
+    expect(auditDiskSpace({ results: [usage({ usedPercent: 10 })] })).toEqual([]);
+  });
+
+  test('just below the threshold stays quiet', () => {
+    const findings = auditDiskSpace({ results: [usage({ usedPercent: DISK_DRIFT_PERCENT - 1 })] });
+    expect(findings).toEqual([]);
+  });
+
+  test('at the drift threshold reports drift, naming host and usage', () => {
+    const findings = auditDiskSpace({ results: [usage({ usedPercent: DISK_DRIFT_PERCENT })] });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.severity).toBe('drift');
+    expect(findings[0]?.code).toBe('disk_low');
+    expect(findings[0]?.message).toContain('celilo-mgr');
+    expect(findings[0]?.message).toContain('85%');
+  });
+
+  test('at the blocked threshold escalates to blocked', () => {
+    const findings = auditDiskSpace({ results: [usage({ usedPercent: DISK_BLOCKED_PERCENT })] });
+
+    expect(findings[0]?.severity).toBe('blocked');
+    expect(findings[0]?.code).toBe('disk_critical');
+  });
+
+  // The alert has to name the host to act on, and suppression resolves a
+  // machine's ancestor key from its HOSTNAME (alerting/suppression.ts). A UUID
+  // subject produces a key suppression can never match — that is #596, filed
+  // against machines_reachable. This check must not repeat it.
+  test('subjects the finding on the hostname, never a UUID', () => {
+    const findings = auditDiskSpace({
+      results: [usage({ hostname: 'iot', usedPercent: 99 })],
+    });
+
+    expect(findings[0]?.subject).toBe('iot');
+  });
+
+  test('only the offending host is reported in a mixed fleet', () => {
+    const findings = auditDiskSpace({
+      results: [
+        usage({ hostname: 'celilo-mgr', usedPercent: 96 }),
+        usage({ hostname: 'iot', usedPercent: 12 }),
+        usage({ hostname: 'dns-ext', usedPercent: 40 }),
+      ],
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.subject).toBe('celilo-mgr');
+  });
+
+  test('reports free space alongside the percentage', () => {
+    const findings = auditDiskSpace({
+      results: [usage({ usedPercent: 96, availableBytes: 6 * 1024 ** 3 })],
+    });
+
+    expect(findings[0]?.message).toContain('6.0 GB free');
+  });
+
+  // Unmeasurable must not read as healthy — but it must not page either, since
+  // machines_reachable is already alerting for the same dead host.
+  test('an unmeasurable host is recorded as todo, not as healthy', () => {
+    const findings = auditDiskSpace({
+      results: [usage({ hostname: 'iot', usedPercent: null, message: 'ssh: connect timed out' })],
+    });
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.severity).toBe('todo');
+    expect(findings[0]?.code).toBe('disk_unmeasured');
+    expect(findings[0]?.details).toContain('timed out');
+  });
+
+  test('an unreachable host does not hide a filling one', () => {
+    const findings = auditDiskSpace({
+      results: [
+        usage({ hostname: 'iot', usedPercent: null, message: 'unreachable' }),
+        usage({ hostname: 'celilo-mgr', usedPercent: 97 }),
+      ],
+    });
+
+    expect(findings.map((f) => f.subject).sort()).toEqual(['celilo-mgr', 'iot']);
+    expect(findings.find((f) => f.subject === 'celilo-mgr')?.severity).toBe('blocked');
+  });
+
+  test('every finding carries the disk_space category', () => {
+    const findings = auditDiskSpace({
+      results: [usage({ usedPercent: 99 }), usage({ hostname: 'iot', usedPercent: null })],
+    });
+
+    expect(findings.every((f) => f.category === 'disk_space')).toBe(true);
+  });
+});

package/src/services/audit/disk-space.ts

@@ -0,0 +1,114 @@
+/**
+ * Disk-space check.
+ *
+ * Catches the failure that had no detector at all: a filesystem filling up.
+ * celilo-mgr reached 34% and climbing at ~4.8 GB/hour from leaked backup
+ * staging, and the only reason anyone noticed was an operator running `df` by
+ * eye. Every one of the eighteen configured monitors watched module health or
+ * machine reachability; not one looked at disk.
+ *
+ * Reports EARLY, not at exhaustion. A check that fires once a filesystem is
+ * full reports an outage instead of preventing one, so the thresholds leave
+ * room to act: `drift` at 85% is "you have time", `blocked` at 95% is "you do
+ * not". On a 117 GB root that is ~17 GB and ~6 GB of headroom respectively —
+ * hours at the leak rate that motivated this, days at any normal one.
+ *
+ * The audit consumes pre-computed measurements so it stays unit-testable
+ * without a live filesystem or SSH client, exactly like `machines-reachable`.
+ */
+
+import type { DriftFinding } from './types';
+
+/** Usage at or above this is divergence worth an operator's attention. */
+export const DISK_DRIFT_PERCENT = 85;
+
+/** Usage at or above this is close enough to exhaustion to gate on. */
+export const DISK_BLOCKED_PERCENT = 95;
+
+export interface DiskUsageResult {
+  /**
+   * User-facing hostname, and the identifier the finding is keyed by.
+   *
+   * NOT the machine's UUID. Suppression resolves a machine's ancestor key from
+   * its hostname (`machineAlertKey` in alerting/suppression.ts), so a finding
+   * subjected on the UUID produces an alert key suppression can never match —
+   * which is exactly the bug filed as #596 against `machines_reachable`. Using
+   * the hostname here also satisfies CLAUDE.md: users never see UUIDs.
+   */
+  hostname: string;
+  ipAddress: string;
+  /** Percent of the root filesystem in use, or null when it could not be measured. */
+  usedPercent: number | null;
+  /** Bytes still available. Omitted when unmeasured. */
+  availableBytes?: number;
+  /** Why the measurement failed, when `usedPercent` is null. */
+  message?: string;
+}
+
+export interface DiskSpaceAuditDeps {
+  results: DiskUsageResult[];
+}
+
+function humanBytes(bytes: number): string {
+  const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return `${value.toFixed(value < 10 && unit > 0 ? 1 : 0)} ${units[unit]}`;
+}
+
+export function auditDiskSpace(deps: DiskSpaceAuditDeps): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+
+  for (const result of deps.results) {
+    // Unmeasurable is NOT healthy — but it does not page either. The host is
+    // already unreachable, `machines_reachable` is already alerting on it, and
+    // a second page for one dead host is noise. `todo` records without
+    // notifying, which is the existing severity for exactly that.
+    if (result.usedPercent === null) {
+      findings.push({
+        category: 'disk_space',
+        severity: 'todo',
+        code: 'disk_unmeasured',
+        message: `${result.hostname}: disk usage could not be measured`,
+        details: result.message,
+        remediation:
+          'The host is unreachable or `df` failed on it. `machines_reachable` covers reachability; this finding only records that disk is currently unknown, not that it is healthy.',
+        actionable: false,
+        subject: result.hostname,
+      });
+      continue;
+    }
+
+    if (result.usedPercent < DISK_DRIFT_PERCENT) continue;
+
+    const critical = result.usedPercent >= DISK_BLOCKED_PERCENT;
+    const free =
+      result.availableBytes === undefined ? '' : `, ${humanBytes(result.availableBytes)} free`;
+
+    findings.push({
+      category: 'disk_space',
+      severity: critical ? 'blocked' : 'drift',
+      code: critical ? 'disk_critical' : 'disk_low',
+      message: `${result.hostname}: root filesystem ${result.usedPercent}% full${free}`,
+      details: critical
+        ? `At or above ${DISK_BLOCKED_PERCENT}% the host is close enough to exhaustion that writes can begin failing. On the management server a full root filesystem takes the event bus and dispatcher with it, including whatever scheduled work would otherwise clean up.`
+        : `At or above ${DISK_DRIFT_PERCENT}% there is still room to act. Find the growth before it becomes an outage rather than after.`,
+      remediation: [
+        `Find what is growing on ${result.hostname}:`,
+        '  df -h /',
+        '  sudo du -xh --max-depth=2 / | sort -h | tail -30',
+        'Then fix the source — a retention policy, a size cap, or a prune',
+        'schedule. A one-off delete leaves the same thing growing.',
+      ].join('\n'),
+      // Multi-step diagnosis, not a one-shot celilo command.
+      actionable: false,
+      subject: result.hostname,
+    });
+  }
+
+  return findings;
+}

package/src/services/audit/index.test.ts

@@ -26,12 +26,14 @@ const emptyDeps = {
   moduleConfigs: { modules: [] },
   health: { results: [] },
   backups: { modules: [] },
+  abandonedOperations: { records: [] },
   undeployedModules: { modules: [] },
   unconfiguredModules: { modules: [] },
   servicesCredentials: { results: [] },
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
 };
 

package/src/services/audit/index.ts

@@ -10,6 +10,10 @@
  * truth for what audit can detect is this file's `AuditDeps` shape.
  */
 
+import {
+  type AbandonedOperationsAuditDeps,
+  auditAbandonedOperations,
+} from './abandoned-operations';
 import { type BackupsAuditDeps, auditBackups } from './backups';
 import { type CapabilityAbiAuditDeps, auditCapabilityAbi } from './capability-abi';
 import { type CliVersionAuditDeps, auditCliVersion } from './cli-version';
@@ -25,6 +29,7 @@ import {
 } from './services-credentials';
 import { type ServicesReachableAuditDeps, auditServicesReachable } from './services-reachable';
 import { type TerraformPlanAuditDeps, auditTerraformPlan } from './terraform-plan';
+import { type TransportReadsAuditDeps, auditTransportReads } from './transport-reads';
 import { type TrustedSourcesAuditDeps, auditTrustedSources } from './trusted-sources';
 import {
   type DriftCategory,
@@ -47,12 +52,14 @@ export interface AuditDeps {
   moduleConfigs: ModuleConfigsAuditDeps;
   health: HealthAuditDeps;
   backups: BackupsAuditDeps;
+  abandonedOperations: AbandonedOperationsAuditDeps;
   undeployedModules: UndeployedModulesAuditDeps;
   unconfiguredModules: UnconfiguredModulesAuditDeps;
   servicesCredentials: ServicesCredentialsAuditDeps;
   secretsDecryptable: SecretsDecryptableAuditDeps;
   servicesReachable: ServicesReachableAuditDeps;
   machinesReachable: MachinesReachableAuditDeps;
+  transportReads: TransportReadsAuditDeps;
   trustedSources: TrustedSourcesAuditDeps;
   /** Defaults to `Date.now()`-based ISO string. */
   now?: () => Date;
@@ -97,12 +104,17 @@ export async function runAudit(
     wrap('module_configs', auditModuleConfigs(deps.moduleConfigs)),
     wrap('health', auditHealth(deps.health)),
     wrap('backups', auditBackups(deps.backups)),
+    wrap(
+      'abandoned_operations',
+      Promise.resolve(auditAbandonedOperations(deps.abandonedOperations)),
+    ),
     wrap('undeployed_modules', auditUndeployedModules(deps.undeployedModules)),
     wrap('unconfigured_modules', auditUnconfiguredModules(deps.unconfiguredModules)),
     wrap('services_credentials', auditServicesCredentials(deps.servicesCredentials)),
     wrap('secrets_decryptable', auditSecretsDecryptable(deps.secretsDecryptable)),
     wrap('services_reachable', auditServicesReachable(deps.servicesReachable)),
     wrap('machines_reachable', auditMachinesReachable(deps.machinesReachable)),
+    wrap('transport_reads', auditTransportReads(deps.transportReads)),
     wrap('trusted_sources', auditTrustedSources(deps.trustedSources)),
   ]);
 

package/src/services/audit/transport-reads.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, test } from 'bun:test';
+import type { TransportReadStatus } from '../alerting/read-records';
+import { auditTransportReads } from './transport-reads';
+
+const NOW = new Date('2026-08-01T12:00:00Z');
+const STALE_AFTER = 30 * 60_000;
+
+const ago = (ms: number) => new Date(NOW.getTime() - ms).toISOString();
+
+function status(over: Partial<TransportReadStatus['last']> | null): TransportReadStatus {
+  return {
+    transportModuleId: 'signal',
+    last:
+      over === null
+        ? null
+        : { at: ago(0), outcome: 'received', messages: 0, lastSuccessAt: ago(0), ...over },
+  };
+}
+
+const run = (statuses: TransportReadStatus[]) =>
+  auditTransportReads({ statuses, now: NOW, staleAfterMs: STALE_AFTER });
+
+describe('auditTransportReads', () => {
+  test('a transport read successfully just now is not a finding', async () => {
+    expect(await run([status({})])).toEqual([]);
+  });
+
+  // THE case this check exists for. Six tokens were issued and zero consumed
+  // over a week, and nothing anywhere was red (#501).
+  test('a transport not read successfully for hours is drift', async () => {
+    const findings = await run([
+      status({
+        at: ago(60_000),
+        outcome: 'failed',
+        error: 'refused',
+        lastSuccessAt: ago(3 * 3600_000),
+      }),
+    ]);
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      category: 'transport_reads',
+      code: 'transport_reads_stale',
+      severity: 'drift',
+      subject: 'signal',
+    });
+    expect(findings[0].message).toContain('3h ago');
+  });
+
+  // The decision that makes staleness safe to page on: an EMPTY read is a
+  // success, so a quiet transport keeps refreshing lastSuccessAt. If empty
+  // reads counted as failure this check would page on every quiet afternoon
+  // and be switched off within a week.
+  test('a quiet transport — successful reads, zero messages — is NOT stale', async () => {
+    const findings = await run([
+      status({ at: ago(0), outcome: 'received', messages: 0, lastSuccessAt: ago(0) }),
+    ]);
+    expect(findings).toEqual([]);
+  });
+
+  test('a transport that has never succeeded is drift, even if attempts are recent', async () => {
+    const findings = await run([
+      status({
+        at: ago(0),
+        outcome: 'failed',
+        error: 'connection refused',
+        lastSuccessAt: undefined,
+      }),
+    ]);
+    expect(findings[0]).toMatchObject({ code: 'transport_never_read', severity: 'drift' });
+    expect(findings[0].details).toContain('connection refused');
+  });
+
+  test('a transport with no record at all is drift, not silently fine', async () => {
+    const findings = await run([status(null)]);
+    expect(findings[0]).toMatchObject({ code: 'transport_never_polled', severity: 'drift' });
+  });
+
+  // A transport with no `receive` is working as designed. Paging about it
+  // would be paging about a healthy system, which teaches operators to ignore
+  // the check.
+  test('a unidirectional transport is never a finding', async () => {
+    const findings = await run([
+      status({ at: ago(10 * 3600_000), outcome: 'unidirectional', lastSuccessAt: undefined }),
+    ]);
+    expect(findings).toEqual([]);
+  });
+
+  test('just inside the threshold is not yet drift', async () => {
+    expect(await run([status({ lastSuccessAt: ago(STALE_AFTER - 1_000) })])).toEqual([]);
+  });
+
+  test('just outside the threshold is drift', async () => {
+    const findings = await run([status({ lastSuccessAt: ago(STALE_AFTER + 1_000) })]);
+    expect(findings).toHaveLength(1);
+  });
+
+  // The remediation must point at something that does not consume the queue.
+  // `celilo alerts poll` would READ, and a suggestion that eats the operator's
+  // acknowledgement is worse than no suggestion (#541).
+  test('a stale finding sends you to the journal, not to a read', async () => {
+    const findings = await run([status({ lastSuccessAt: ago(3 * 3600_000) })]);
+    expect(findings[0].remediation).toBe('celilo module journal signal');
+  });
+
+  test('each transport is judged on its own record', async () => {
+    const findings = await run([
+      { transportModuleId: 'signal', last: status({}).last },
+      { transportModuleId: 'sms', last: status({ lastSuccessAt: ago(9 * 3600_000) }).last },
+    ]);
+    expect(findings).toHaveLength(1);
+    expect(findings[0].subject).toBe('sms');
+  });
+});

package/src/services/audit/transport-reads.ts

@@ -0,0 +1,120 @@
+/**
+ * Transport-reads check — is celilo still able to READ replies?
+ *
+ * Every other signal that a notification transport is working proves the wrong
+ * half. `send` succeeding proves outbound. A daemon answering its API proves a
+ * socket. Neither can see the return leg fail, and for a week none of them did:
+ * six alert tokens were issued, zero were consumed, and nothing anywhere was
+ * red (#501).
+ *
+ * This is the check that would have caught it. It asserts the contract —
+ * celilo can read this transport — using first-hand evidence rather than a
+ * proxy: the recorded outcome of the reads the poller already performs every
+ * few minutes.
+ *
+ * WHY STALENESS IS A SOUND SIGNAL HERE, and it rests on one decision:
+ * an empty read is recorded as a SUCCESS. A transport nobody has replied on
+ * still records a successful read on every poll. So "no successful read in a
+ * while" cannot mean "quiet" — it can only mean the reads stopped happening or
+ * stopped working. Had zero-messages been recorded as failure, this check would
+ * page every time an operator had a peaceful afternoon, and would be turned off
+ * within a week.
+ *
+ * Deliberately consumes pre-computed state rather than reading the store
+ * itself, so it stays unit-testable and cannot become a second thing that
+ * performs reads. A check that drained the queue to find out whether the queue
+ * could be drained would eat the acknowledgement it was protecting (#541).
+ */
+
+import type { TransportReadStatus } from '../alerting/read-records';
+import type { DriftFinding } from './types';
+
+export type { TransportReadStatus };
+
+export interface TransportReadsAuditDeps {
+  /** One entry per transport that has at least one route pointing at it. */
+  statuses: TransportReadStatus[];
+  now: Date;
+  /**
+   * How long without a successful read before it counts as drift.
+   *
+   * The poller runs every five minutes, so this is a multiple of that rather
+   * than a guess: it has to absorb a missed tick, a slow sweep, and a restart
+   * without crying wolf, while still catching a transport that has genuinely
+   * stopped being readable.
+   */
+  staleAfterMs: number;
+}
+
+const CATEGORY = 'transport_reads' as const;
+
+function describeAge(ms: number): string {
+  const mins = Math.floor(ms / 60_000);
+  if (mins < 60) return `${mins}m`;
+  const hours = Math.floor(mins / 60);
+  return hours < 48 ? `${hours}h` : `${Math.floor(hours / 24)}d`;
+}
+
+export async function auditTransportReads(deps: TransportReadsAuditDeps): Promise<DriftFinding[]> {
+  const findings: DriftFinding[] = [];
+
+  for (const status of deps.statuses) {
+    const id = status.transportModuleId;
+
+    // Nothing recorded at all. Either the poller has never run, or this
+    // transport was added and never polled. Both mean no reply from here has
+    // ever been collectable, which is worth saying out loud rather than
+    // treating an empty store as "fine so far".
+    if (!status.last) {
+      findings.push({
+        category: CATEGORY,
+        severity: 'drift',
+        code: 'transport_never_polled',
+        message: `${id}: celilo has never recorded a read attempt`,
+        details:
+          'No inbound read has been attempted for this transport, so a\n' +
+          'reply sent to it would not be collected. This is the state a\n' +
+          'newly-added transport is in until the first poll runs.',
+        remediation: 'celilo alerts poll',
+        actionable: true,
+        subject: id,
+      });
+      continue;
+    }
+
+    // A transport with no `receive` is unidirectional BY DESIGN — pages go out,
+    // replies were never possible, and the route's can_ack already records
+    // that. Flagging it would be flagging a working system.
+    if (status.last.outcome === 'unidirectional') continue;
+
+    if (!status.last.lastSuccessAt) {
+      findings.push({
+        category: CATEGORY,
+        severity: 'drift',
+        code: 'transport_never_read',
+        message: `${id}: no read has ever SUCCEEDED`,
+        details: `Reads have been attempted — the most recent was ${status.last.outcome}${status.last.error ? ` (${status.last.error})` : ''} — but none has\never succeeded. Acknowledgements sent to this transport cannot be\ncollected, and outbound paging will keep working, so nothing else\nwill report this.`,
+        remediation: `celilo module journal ${id}`,
+        actionable: true,
+        subject: id,
+      });
+      continue;
+    }
+
+    const age = deps.now.getTime() - new Date(status.last.lastSuccessAt).getTime();
+    if (age > deps.staleAfterMs) {
+      findings.push({
+        category: CATEGORY,
+        severity: 'drift',
+        code: 'transport_reads_stale',
+        message: `${id}: last successful read ${describeAge(age)} ago`,
+        details: `The most recent attempt was ${status.last.outcome}${status.last.error ? `: ${status.last.error}` : ''}.\nAn empty read still counts as a success, so this is not "nobody\nreplied" — reads are either not happening or not working, and a\nreply sent now would not be collected.`,
+        remediation: `celilo module journal ${id}`,
+        actionable: true,
+        subject: id,
+      });
+    }
+  }
+
+  return findings;
+}

package/src/services/audit/types.ts

@@ -30,12 +30,15 @@ export type DriftCategory =
   | 'module_configs'
   | 'health'
   | 'backups'
+  | 'abandoned_operations'
   | 'undeployed_modules'
   | 'unconfigured_modules'
   | 'services_credentials'
   | 'secrets_decryptable'
   | 'services_reachable'
   | 'machines_reachable'
+  | 'disk_space'
+  | 'transport_reads'
   | 'trusted_sources';
 
 export type DriftSeverity = 'todo' | 'drift' | 'blocked';

package/src/services/backup-create.ts

@@ -4,7 +4,6 @@
  */
 
 import { copyFileSync, existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { getDbPath } from '../config/paths';
@@ -20,6 +19,7 @@ import { encryptFileToFile } from './backup-cipher';
 import { buildManifest } from './backup-manifest';
 import { completeBackup, createBackupRecord, failBackup, listBackups } from './backup-metadata';
 import type { BackupSchedule } from './backup-schedule';
+import { stagingDirFor } from './backup-staging';
 import {
   createStorageProvider,
   getBackupStorage,
@@ -113,7 +113,7 @@ export async function createSystemStateBackup(
   });
   const opId = startOperation('__system__', 'backup');
 
-  const tempDir = join(tmpdir(), `celilo-backup-${record.id}`);
+  const tempDir = stagingDirFor(record.id);
 
   try {
     mkdirSync(tempDir, { recursive: true });
@@ -328,7 +328,7 @@ export async function createModuleBackup(
   // Envelope layout (v1.0):
   //   manifest.json   - schema version, host, moduleId, dataSchemaVersion
   //   data/           - on_backup hook artifacts (the hook treats this as backup_dir)
-  const tempDir = join(tmpdir(), `celilo-backup-${record.id}`);
+  const tempDir = stagingDirFor(record.id);
   const envelopeDir = join(tempDir, 'envelope');
   const dataDir = join(envelopeDir, 'data');
 
@@ -496,7 +496,7 @@ export async function importModuleBackup(
     moduleVersion: manifest.version,
   });
 
-  const tempDir = join(tmpdir(), `celilo-backup-${record.id}`);
+  const tempDir = stagingDirFor(record.id);
   const artifactDir = join(tempDir, 'artifacts');
 
   try {

package/src/services/backup-in-flight-refusal.test.ts

@@ -129,6 +129,7 @@ describe('backup/restore in-flight refusal', () => {
         status: 'completed' as const,
         errorMessage: null,
         name: null,
+        pid: process.pid,
         startedAt: new Date(),
         completedAt: null,
       };
@@ -152,6 +153,7 @@ describe('backup/restore in-flight refusal', () => {
         status: 'completed' as const,
         errorMessage: null,
         name: null,
+        pid: process.pid,
         startedAt: new Date(),
         completedAt: null,
       };