@celilo/cli 0.23.0 → 0.24.0

package/src/services/audit/interface-classification.ts

@@ -0,0 +1,167 @@
+/**
+ * Firewall interface classification, reported where an operator already looks.
+ *
+ * The condition that produced `fw-keeper.sh` was not that celilo lacked
+ * information — it was that celilo said nothing. An interface it cannot
+ * attribute is an unowned network segment on a firewall, and one that is never
+ * surfaced is discovered as an outage rather than as a finding.
+ *
+ * What this reports, per firewall:
+ *
+ *   - every interface celilo cannot attribute, by name AND address;
+ *   - a carrier-grade NAT interface, which celilo refuses to converge on;
+ *   - an ambiguous external edge — more than one public leg, none designated;
+ *   - a default route leaving through neither `internal` nor `external`.
+ *
+ * The last three are BLOCKING, matching what the converge does with them. An
+ * audit that called them drift while the converge refused would be telling the
+ * operator something different from what the system does.
+ *
+ * Pure, like every other checker here: it consumes a pre-computed view so it is
+ * unit-testable without SSH or a live firewall.
+ *
+ * openspec: firewall-interface-classification §10 (design D1, D2, D11)
+ */
+
+import {
+  type InterfaceAddress,
+  type ZoneDeclaration,
+  classifyInterfaces,
+  defaultRouteFinding,
+  externalEdge,
+  isPubliclyRoutable,
+  subnetContains,
+} from '@celilo/capabilities';
+import type { DriftFinding } from './types';
+
+/** RFC 6598. celilo refuses to converge on one — see design D2 (amended). */
+const CARRIER_GRADE_NAT = '100.64.0.0/10';
+
+export interface FirewallInterfaceView {
+  /**
+   * User-facing hostname, and the key the finding is subjected on.
+   *
+   * NOT the machine UUID: suppression resolves a machine's ancestor key from
+   * its hostname, so a finding subjected on a UUID produces an alert key
+   * suppression can never match (#596). Users never see UUIDs either.
+   */
+  hostname: string;
+  /** Every address the firewall holds, as read from the box. */
+  interfaces: InterfaceAddress[];
+  /** The zones this firewall declares, with the subnets that define them. */
+  zones: ZoneDeclaration[];
+  /** The interface carrying the default route, when celilo knows it. */
+  defaultRouteInterface?: string | null;
+  /** The operator's designated edge, from the firewall's `zone.external.ip`. */
+  designatedExternalIp?: string | null;
+}
+
+/**
+ * Findings for one firewall's interfaces.
+ *
+ * Ordered most-severe first so the report reads top-down: the reasons a
+ * converge would refuse, then the interfaces that are merely unaccounted for.
+ */
+export function auditFirewallInterfaces(view: FirewallInterfaceView): DriftFinding[] {
+  const findings: DriftFinding[] = [];
+  const classifications = classifyInterfaces(view.interfaces, view.zones);
+
+  // ── Blocking: a carrier address celilo cannot reason about ────────────────
+  const carrier = view.interfaces.filter((i) => subnetContains(CARRIER_GRADE_NAT, i.ip));
+  for (const iface of carrier) {
+    findings.push({
+      category: 'interface_classification',
+      severity: 'blocked',
+      code: 'carrier_grade_nat_interface',
+      subject: view.hostname,
+      message: `${view.hostname}: ${iface.name} holds a carrier-grade NAT address (${iface.ip})`,
+      details:
+        "RFC 6598 space belongs to the carrier and is shared with other subscribers, so it cannot tell celilo the fleet's real external address. celilo does not know what such an interface is for, whether to NAT on it, or what reach it should have, so it refuses to converge rather than guessing. Only ISP equipment should hold one.",
+      remediation:
+        'Remove the carrier-grade NAT interface from this firewall, or place the ISP boundary on separate equipment (celilo drives an upstream router through the firewall capability).',
+      actionable: false,
+    });
+  }
+
+  // ── Blocking: two public legs and no designation ──────────────────────────
+  const edge = externalEdge(classifications, view.designatedExternalIp);
+  if (edge.kind === 'ambiguous') {
+    const named = edge.candidates.map((c) => `${c.name} (${c.ip})`).join(', ');
+    findings.push({
+      category: 'interface_classification',
+      severity: 'blocked',
+      code: 'ambiguous_external_edge',
+      subject: view.hostname,
+      message: `${view.hostname}: ${edge.candidates.length} publicly routable interfaces and none designated — ${named}`,
+      details:
+        'celilo will not pick an external edge by interface order. Before this check the first non-private address won silently, so a box with two public addresses had its edge chosen by enumeration with no warning and no way to override.',
+      remediation: `celilo module config set <firewall-module> zone.external.ip <one of: ${edge.candidates
+        .map((c) => c.ip)
+        .join(', ')}>`,
+      actionable: false,
+    });
+  }
+
+  // ── Blocking: egress leaving through a segment celilo cannot describe ─────
+  if (view.defaultRouteInterface !== undefined) {
+    const routeFinding = defaultRouteFinding(classifications, view.defaultRouteInterface);
+    if (routeFinding) {
+      findings.push({
+        category: 'interface_classification',
+        severity: 'blocked',
+        code: 'default_route_off_edge',
+        subject: view.hostname,
+        message: `${view.hostname}: ${routeFinding.message}`,
+        details:
+          'celilo supports two shapes: a firewall that owns its WAN egresses through its external leg, and a downstream firewall egresses via an upstream router on the internal segment. Egress anywhere else leaves through a segment celilo cannot describe.',
+        remediation:
+          'Move the default route onto the external or internal leg, or declare a zone for the interface that carries it.',
+        actionable: false,
+      });
+    }
+  }
+
+  // ── Drift: interfaces nobody accounted for ────────────────────────────────
+  const alien = classifications.filter((c) => c.role === 'alien');
+  if (alien.length > 0) {
+    const named = alien.map((c) => `${c.name} (${c.ip})`).join(', ');
+    findings.push({
+      category: 'interface_classification',
+      severity: 'drift',
+      code: 'alien_interfaces',
+      subject: view.hostname,
+      message: `${view.hostname}: ${alien.length} interface(s) celilo cannot attribute — ${named}`,
+      details:
+        'An interface in no declared zone is an unowned network segment on a firewall. celilo refuses to converge a firewall it is onboarding until every interface is accounted for; on one it has already brought to a known-good state, a NEWLY appeared interface like this is disabled.',
+      remediation: `celilo system config set network.<zone>.subnet <cidr>  # then add the zone to the firewall's declared zones`,
+      actionable: false,
+    });
+  }
+
+  return findings;
+}
+
+/** Every firewall's findings, flattened. */
+export function auditInterfaceClassification(views: FirewallInterfaceView[]): DriftFinding[] {
+  return views.flatMap(auditFirewallInterfaces);
+}
+
+/**
+ * The classification itself, for the report body rather than as a finding.
+ *
+ * §10.2 requires a fully declared firewall to produce NO findings, so the
+ * per-interface roles cannot be findings — they are what an operator reads to
+ * confirm the picture is what they intended.
+ */
+export function describeClassification(view: FirewallInterfaceView): string[] {
+  return classifyInterfaces(view.interfaces, view.zones).map((c) => {
+    if (c.role === 'zone') return `${c.name}: ${c.ip} → zone:${c.zone}`;
+    if (c.role === 'external') {
+      return `${c.name}: ${c.ip} → external (the WAN edge)`;
+    }
+    const why = isPubliclyRoutable(c.ip)
+      ? 'publicly routable but unclaimed'
+      : 'no declared subnet contains it';
+    return `${c.name}: ${c.ip} → alien (${why})`;
+  });
+}

package/src/services/audit/types.ts

@@ -40,7 +40,8 @@ export type DriftCategory =
   | 'public_dns'
   | 'disk_space'
   | 'transport_reads'
-  | 'trusted_sources';
+  | 'trusted_sources'
+  | 'interface_classification';
 
 export type DriftSeverity = 'todo' | 'drift' | 'blocked';
 

package/src/services/backup-age-agreement.test.ts

@@ -0,0 +1,118 @@
+/**
+ * The run path and the alert path must agree about how old a backup is.
+ *
+ * They did not. `isBackupDue` measured from `backups.startedAt` while the
+ * freshness audit measured from `completedAt`, so the two disagreed by however
+ * long the backup itself took — 5.5 minutes for forgejo, and unbounded for
+ * anything larger. The shared accessor prevented drift where it was looking and
+ * the drift moved into the columns underneath it (design.md D6).
+ *
+ * This is the gate for that: one completed backup whose start and finish are
+ * far apart, read by both paths, which must return the same instant.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { backupStorages, backups, modules } from '../db/schema';
+import { loadBackupAuditInfo } from './audit/backup-source';
+import { findBackupEligibleModules } from './backup-create';
+import { loadBackupHistory } from './backup-metadata';
+import { BACKUP_SCHEDULE_CONFIG_KEY, effectiveBackupSchedule } from './backup-schedule';
+import { parseCadence } from './cadence';
+import { configOverride, upsertModuleConfig } from './module-config';
+
+const STARTED = new Date('2026-04-25T00:00:00Z');
+// Six hours later — an extreme but not absurd gap for a multi-gigabyte module.
+const COMPLETED = new Date('2026-04-25T06:00:00Z');
+
+describe('backup age: the run path and the audit path read the same column', () => {
+  let dir: string;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-backup-age-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+
+    const db = getDb();
+    db.insert(modules)
+      .values({
+        id: 'forgejo',
+        name: 'Forgejo',
+        sourcePath: dir,
+        version: '1.0.0',
+        state: 'INSTALLED',
+        manifestData: {
+          id: 'forgejo',
+          hooks: { on_backup: { script: './backup.ts' } },
+          backup: { schedule: 'daily' },
+        },
+      })
+      .run();
+    db.insert(backupStorages)
+      .values({
+        id: 'storage-1',
+        storageId: 'local',
+        name: 'Local',
+        providerName: 'local',
+        credentialsEncrypted: '',
+        providerConfig: {},
+        verified: true,
+      })
+      .run();
+    db.insert(backups)
+      .values({
+        id: 'backup-1',
+        moduleId: 'forgejo',
+        storageId: 'storage-1',
+        storagePath: '2026-04-25/forgejo.backup',
+        backupType: 'module_data',
+        status: 'completed',
+        startedAt: STARTED,
+        completedAt: COMPLETED,
+      })
+      .run();
+  });
+
+  afterEach(() => {
+    closeDb();
+    process.env.CELILO_DB_PATH = undefined;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('both measure from when the backup COMPLETED, not when it started', () => {
+    const history = loadBackupHistory('forgejo');
+    const [audited] = loadBackupAuditInfo(getDb());
+
+    expect(history.lastSuccessAt?.getTime()).toBe(COMPLETED.getTime());
+    expect(audited.lastSuccessfulBackupAt).toBe(COMPLETED.getTime());
+    expect(history.lastSuccessAt?.getTime()).toBe(audited.lastSuccessfulBackupAt ?? 0);
+  });
+
+  test('both resolve the same cadence for the same module', () => {
+    const [audited] = loadBackupAuditInfo(getDb());
+    const fromAudit = effectiveBackupSchedule(audited.manifest, audited.scheduleOverride);
+
+    expect(fromAudit).toEqual({ minutes: 24 * 60 });
+    expect(parseCadence('daily')).toEqual(fromAudit);
+  });
+
+  test("an operator's override reaches the sweep and the audit alike", () => {
+    upsertModuleConfig(getDb(), 'forgejo', BACKUP_SCHEDULE_CONFIG_KEY, '6h');
+
+    const [audited] = loadBackupAuditInfo(getDb());
+    const [eligible] = findBackupEligibleModules();
+
+    const fromAudit = effectiveBackupSchedule(audited.manifest, audited.scheduleOverride);
+    const fromSweep = effectiveBackupSchedule(
+      eligible.manifest,
+      configOverride(eligible.configs, BACKUP_SCHEDULE_CONFIG_KEY),
+    );
+
+    expect(fromAudit).toEqual({ minutes: 360 });
+    expect(fromSweep).toEqual(fromAudit);
+  });
+});

package/src/services/backup-create.ts

@@ -17,8 +17,13 @@ import { getOrCreateMasterKey } from '../secrets/master-key';
 import { shellEscape } from '../utils/shell';
 import { encryptFileToFile } from './backup-cipher';
 import { buildManifest } from './backup-manifest';
-import { completeBackup, createBackupRecord, failBackup, listBackups } from './backup-metadata';
-import type { BackupSchedule } from './backup-schedule';
+import {
+  completeBackup,
+  createBackupRecord,
+  failBackup,
+  loadBackupHistory,
+} from './backup-metadata';
+import { isBackupDueFromHistory } from './backup-schedule';
 import { stagingDirFor } from './backup-staging';
 import {
   createStorageProvider,
@@ -26,8 +31,10 @@ import {
   getBackupStorageByStorageId,
   getDefaultBackupStorage,
 } from './backup-storage';
+import type { Cadence } from './cadence';
 import { materializeCrossModuleRoot, moduleHasCrossModuleRead } from './cross-module-read';
 import { getModuleSystems } from './deployed-systems';
+import { parseStoredConfigValue } from './module-config';
 import {
   completeOperation,
   failOperation,
@@ -49,8 +56,6 @@ export interface BackupCreateResult {
   error?: string;
 }
 
-export type { BackupSchedule } from './backup-schedule';
-
 /**
  * Resolve the target storage destination
  */
@@ -198,46 +203,47 @@ export async function createSystemStateBackup(
 }
 
 /**
- * Schedule intervals in milliseconds
- */
-const SCHEDULE_INTERVALS: Record<BackupSchedule, number> = {
-  hourly: 60 * 60 * 1000,
-  daily: 24 * 60 * 60 * 1000,
-  weekly: 7 * 24 * 60 * 60 * 1000,
-  monthly: 30 * 24 * 60 * 60 * 1000,
-  manual: Number.POSITIVE_INFINITY,
-};
-
-/**
- * Check if a module is due for backup based on its schedule
+ * Check if a module is due for backup based on its schedule.
+ *
+ * The policy lives in `isBackupDueFromHistory`; this reads the history it
+ * needs. Worth knowing what the previous version did, because its shape was
+ * the bug: it asked for `limit: 1` — the single most recent row, whatever its
+ * outcome — and then `.find()`-ed a *completed* one within that. Those two
+ * lines contradict each other. Once an attempt failed, the newest row was that
+ * failure, the find matched nothing, and "no successful backup exists" meant
+ * unconditionally due — at every hourly tick, forever, however the module's
+ * cadence read (celilo#685).
  */
-export function isBackupDue(moduleId: string, schedule: BackupSchedule): boolean {
-  if (schedule === 'manual') return false;
-
-  const existing = listBackups({ moduleId, limit: 1 });
-  const lastBackup = existing.find(
-    (b) => b.moduleId === moduleId && b.status === 'completed' && b.backupType === 'module_data',
-  );
-
-  if (!lastBackup) return true;
-
-  const elapsed = Date.now() - new Date(lastBackup.startedAt).getTime();
-  return elapsed >= SCHEDULE_INTERVALS[schedule];
+export function isBackupDue(moduleId: string, schedule: Cadence): boolean {
+  return isBackupDueFromHistory(schedule, loadBackupHistory(moduleId), Date.now());
 }
 
 /**
- * Find all installed modules that have an on_backup hook
+ * Find all installed modules that have an on_backup hook.
+ *
+ * Each carries its operator config alongside its manifest, because every
+ * caller then has to resolve a cadence or a retention policy out of the two
+ * together — and a caller that got the manifest alone would silently ignore
+ * the operator's override.
  */
 export function findBackupEligibleModules(): Array<{
   module: typeof modules.$inferSelect;
   manifest: ModuleManifest;
+  configs: Record<string, unknown>;
 }> {
   const db = getDb();
   const allModules = db.select().from(modules).all();
+  const configsByModule = new Map<string, Record<string, unknown>>();
+  for (const row of db.select().from(moduleConfigs).all()) {
+    const forModule = configsByModule.get(row.moduleId) ?? {};
+    forModule[row.key] = parseStoredConfigValue(row);
+    configsByModule.set(row.moduleId, forModule);
+  }
 
   const eligible: Array<{
     module: typeof modules.$inferSelect;
     manifest: ModuleManifest;
+    configs: Record<string, unknown>;
   }> = [];
 
   for (const mod of allModules) {
@@ -246,7 +252,7 @@ export function findBackupEligibleModules(): Array<{
     const manifest = mod.manifestData as unknown as ModuleManifest;
     if (!manifest.hooks?.on_backup) continue;
 
-    eligible.push({ module: mod, manifest });
+    eligible.push({ module: mod, manifest, configs: configsByModule.get(mod.id) ?? {} });
   }
 
   return eligible;

package/src/services/backup-metadata.ts

@@ -4,9 +4,10 @@
  */
 
 import { randomUUID } from 'node:crypto';
-import { desc, eq, like } from 'drizzle-orm';
+import { and, desc, eq, gt, isNotNull, like } from 'drizzle-orm';
 import { getDb } from '../db/client';
 import { type Backup, type BackupStatus, type BackupType, backups } from '../db/schema';
+import type { BackupHistory } from './backup-schedule';
 
 /** Short ID length used for display and lookup */
 export const SHORT_ID_LENGTH = 8;
@@ -156,6 +157,56 @@ export function listBackups(options?: {
   return db.select().from(backups).orderBy(desc(backups.startedAt)).limit(limit).all();
 }
 
+/**
+ * What a module's backup history says, for the due-ness decision.
+ *
+ * Only `module_data` rows count. A module's cadence is about its own data; a
+ * system backup that happens to name it must not make it look covered.
+ *
+ * Split from the decision itself so the policy stays pure and testable
+ * (Rule 2.3) — see `isBackupDueFromHistory`.
+ */
+export function loadBackupHistory(moduleId: string): BackupHistory {
+  const db = getDb();
+  const forThisModule = and(eq(backups.moduleId, moduleId), eq(backups.backupType, 'module_data'));
+
+  // Ordered and measured by `completedAt`, matching the freshness audit
+  // (services/audit/backup-source.ts). Measuring due-ness from `startedAt`
+  // while the audit measured from `completedAt` meant the two paths could
+  // disagree about a module's age by the duration of the backup itself —
+  // design.md D6. A `completed` row with no `completedAt` is not a backup
+  // either path will count.
+  const [lastSuccess] = db
+    .select()
+    .from(backups)
+    .where(and(forThisModule, eq(backups.status, 'completed'), isNotNull(backups.completedAt)))
+    .orderBy(desc(backups.completedAt))
+    .limit(1)
+    .all();
+
+  const [lastAttempt] = db
+    .select()
+    .from(backups)
+    .where(forThisModule)
+    .orderBy(desc(backups.startedAt))
+    .limit(1)
+    .all();
+
+  // Attempts since the last success — every row newer than it, or every row at
+  // all when there has never been one. An `in_progress` row is included: the
+  // decision only ever uses this to back OFF, so counting a live attempt is
+  // the safe direction.
+  const since = lastSuccess
+    ? and(forThisModule, gt(backups.startedAt, lastSuccess.startedAt))
+    : forThisModule;
+
+  return {
+    lastSuccessAt: lastSuccess?.completedAt ?? null,
+    lastAttemptAt: lastAttempt?.startedAt ?? null,
+    consecutiveFailures: db.select({ id: backups.id }).from(backups).where(since).all().length,
+  };
+}
+
 /**
  * Every backup record still claiming to be in progress, oldest first.
  *

package/src/services/backup-retention.test.ts

@@ -0,0 +1,123 @@
+/**
+ * Retention resolves per dimension, and an unset dimension is UNBOUNDED.
+ *
+ * The trap this file exists for: `backup.retention` is an optional block, so a
+ * manifest that omits it prunes nothing at all — its inner `count: 7` /
+ * `max_age_days: 30` defaults never apply. If setting one dimension let the
+ * other fall back to those defaults, an operator asking to keep 3 copies would
+ * silently arm a 30-day deletion on a module that had been keeping everything.
+ * Every other failure here is recoverable; that one destroys backups.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import type { Backup } from '../db/schema';
+import type { ModuleManifest } from '../manifest/schema';
+import {
+  BACKUP_RETENTION_COUNT_CONFIG_KEY,
+  BACKUP_RETENTION_MAX_AGE_DAYS_CONFIG_KEY,
+  effectiveBackupRetention,
+  identifyExpiredBackups,
+  prunesNothing,
+} from './backup-retention';
+
+const DAY = 24 * 60 * 60 * 1000;
+const UNBOUNDED = Number.POSITIVE_INFINITY;
+
+function manifestWith(retention?: { count?: number; max_age_days?: number }): ModuleManifest {
+  return { backup: retention ? { retention } : undefined } as unknown as ModuleManifest;
+}
+
+/** Newest first, matching what `listCompletedBackupsForModule` returns. */
+function backupsAgedDays(...ages: number[]): Backup[] {
+  return ages.map(
+    (days, i) =>
+      ({
+        id: `backup-${i}`,
+        storagePath: `path-${i}`,
+        storageId: 'storage-1',
+        startedAt: new Date(Date.now() - days * DAY),
+      }) as unknown as Backup,
+  );
+}
+
+describe('effectiveBackupRetention', () => {
+  test('nothing declared and nothing set is unbounded in both dimensions', () => {
+    const policy = effectiveBackupRetention(manifestWith(), {});
+    expect(policy).toEqual({ count: UNBOUNDED, maxAgeDays: UNBOUNDED });
+    expect(prunesNothing(policy)).toBe(true);
+  });
+
+  // THE data-loss trap. Setting one dimension must not arm the other.
+  test('setting one dimension leaves the other unbounded when the manifest declares none', () => {
+    const policy = effectiveBackupRetention(manifestWith(), {
+      [BACKUP_RETENTION_COUNT_CONFIG_KEY]: 3,
+    });
+
+    expect(policy.count).toBe(3);
+    expect(policy.maxAgeDays).toBe(UNBOUNDED);
+    expect(prunesNothing(policy)).toBe(false);
+  });
+
+  test('an override bounds one dimension while the manifest bounds the other', () => {
+    const policy = effectiveBackupRetention(manifestWith({ count: 7, max_age_days: 30 }), {
+      [BACKUP_RETENTION_COUNT_CONFIG_KEY]: 3,
+    });
+
+    expect(policy).toEqual({ count: 3, maxAgeDays: 30 });
+  });
+
+  test('both dimensions can be overridden independently', () => {
+    const policy = effectiveBackupRetention(manifestWith({ count: 7, max_age_days: 30 }), {
+      [BACKUP_RETENTION_COUNT_CONFIG_KEY]: 2,
+      [BACKUP_RETENTION_MAX_AGE_DAYS_CONFIG_KEY]: 90,
+    });
+
+    expect(policy).toEqual({ count: 2, maxAgeDays: 90 });
+  });
+
+  test("the manifest's suggestion applies when nobody has overridden", () => {
+    expect(effectiveBackupRetention(manifestWith({ count: 7, max_age_days: 30 }), {})).toEqual({
+      count: 7,
+      maxAgeDays: 30,
+    });
+  });
+
+  test('a non-positive or unparseable override falls back rather than deleting everything', () => {
+    // Validated at SET time, so this is hand-edited state. A `0` read as "keep
+    // zero copies" would delete every backup the module has.
+    for (const bad of [0, -1, 'lots', 2.5]) {
+      const policy = effectiveBackupRetention(manifestWith({ count: 7, max_age_days: 30 }), {
+        [BACKUP_RETENTION_COUNT_CONFIG_KEY]: bad,
+      });
+      expect(policy.count).toBe(7);
+    }
+  });
+});
+
+describe('identifyExpiredBackups with unbounded dimensions', () => {
+  test('an unbounded count never prunes on count', () => {
+    const expired = identifyExpiredBackups(backupsAgedDays(1, 2, 3, 4, 5), {
+      count: UNBOUNDED,
+      maxAgeDays: UNBOUNDED,
+    });
+    expect(expired).toEqual([]);
+  });
+
+  test('a bounded count prunes past it, and age alone prunes nothing', () => {
+    const expired = identifyExpiredBackups(backupsAgedDays(1, 2, 100, 200), {
+      count: 3,
+      maxAgeDays: UNBOUNDED,
+    });
+
+    expect(expired.map((b) => b.id)).toEqual(['backup-3']);
+  });
+
+  test('a bounded age prunes past it while every copy is kept on count', () => {
+    const expired = identifyExpiredBackups(backupsAgedDays(1, 2, 100), {
+      count: UNBOUNDED,
+      maxAgeDays: 30,
+    });
+
+    expect(expired.map((b) => b.id)).toEqual(['backup-2']);
+  });
+});