@celilo/cli 0.23.0 → 0.24.1

package/src/cli/commands/firewall-interface-list.ts

@@ -0,0 +1,123 @@
+/**
+ * `celilo firewall interface list [<hostname>]`
+ *
+ * The interface classification, on demand, with no side effects.
+ *
+ * A converge already refuses or isolates on what it finds — but only when it
+ * runs, and only in the middle of a deploy's output. An operator about to
+ * onboard a firewall, or wondering why one refused, needs to be able to ASK.
+ * The condition that produced `fw-keeper.sh` was not that celilo lacked the
+ * information; it was that celilo never said it.
+ *
+ * Read-only by construction: it reads the stored interface table and the
+ * declarations, and classifies in memory. It never touches the box, so it is
+ * safe to run against a firewall that is currently refusing.
+ */
+
+import { classifyInterfaces, isPubliclyRoutable } from '@celilo/capabilities';
+import { getDb } from '../../db/client';
+import { listFirewallIps, readDeclaredNetworks } from '../../hooks/capability-loader';
+import { listMachines } from '../../services/machine-pool';
+import { celiloIntro } from '../prompts';
+import type { CommandResult } from '../types';
+
+/**
+ * Every network a subnet is declared for — THE same reader the converge uses.
+ *
+ * This command's whole value is telling an operator what the next converge will
+ * do, so reading declarations a second way is not a duplication smell, it is a
+ * correctness bug: this file walked `NETWORK_ZONES` and so could not see
+ * `network.control-plane-vpn.subnet`. It would have reported `wg0` as ALIEN —
+ * "this will be isolated" — about an interface the converge attributes and
+ * leaves alone. The operator's most likely response to that reading is to go
+ * and remove their own admin VPN.
+ */
+async function declaredZones(): Promise<Array<{ zone: string; subnet: string }>> {
+  return readDeclaredNetworks(getDb());
+}
+
+/** One line per interface, explaining the role rather than just naming it. */
+function describe(role: string, zone: string | undefined, ip: string): string {
+  if (role === 'zone') return `zone:${zone}`;
+  if (role === 'external') return 'external — the WAN edge';
+  return isPubliclyRoutable(ip)
+    ? 'ALIEN — publicly routable but no declared zone claims it'
+    : 'ALIEN — no declared subnet contains it';
+}
+
+export async function handleFirewallInterfaceList(
+  args: string[],
+  _flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  celiloIntro('Firewall interfaces');
+
+  const wanted = args[0];
+  const machines = await listMachines();
+  // A firewall is a machine a firewall provider MANAGES. `role === 'router'` is
+  // kept as a second way in, but it cannot be the only one: the role is decided
+  // by `machine add` from the zones declared at that moment, and the normal
+  // order is to add the machine and THEN deploy iptables, whose `on_install`
+  // writes the zone subnets. So a working firewall is recorded as a plain host,
+  // and this command — whose entire purpose is to report on firewalls — answered
+  // "No firewalls in the machine pool" on a fleet that had one.
+  //
+  // Named explicitly, the hostname wins, so an operator can inspect any box.
+  const firewallIps = new Set(await listFirewallIps(getDb()));
+  const targets = wanted
+    ? machines.filter((m) => m.hostname === wanted)
+    : machines.filter((m) => firewallIps.has(m.ipAddress) || m.role === 'router');
+
+  if (targets.length === 0) {
+    return {
+      success: false,
+      error: wanted
+        ? `No machine named "${wanted}". Run \`celilo machine list\` to see the pool.`
+        : 'No firewalls in the machine pool. celilo looks for a machine managed by a firewall provider, or one it classified as a router.',
+    };
+  }
+
+  const zones = await declaredZones();
+  if (zones.length === 0) {
+    console.log(
+      'No zone subnets are declared, so every interface will read as unaccounted for.\n' +
+        'Declare them with: celilo system config set network.<zone>.subnet <cidr>\n',
+    );
+  }
+
+  let alienTotal = 0;
+  for (const machine of targets) {
+    console.log(`\n${machine.hostname} (${machine.ipAddress})`);
+
+    const interfaces = (machine.interfaces ?? []).map((i) => ({
+      name: i.name,
+      ip: i.ipAddress,
+    }));
+    if (interfaces.length === 0) {
+      console.log('  no interfaces recorded — re-run `celilo machine add` to detect them');
+      continue;
+    }
+
+    for (const c of classifyInterfaces(interfaces, zones)) {
+      if (c.role === 'alien') alienTotal += 1;
+      console.log(`  ${c.name.padEnd(8)} ${c.ip.padEnd(16)} ${describe(c.role, c.zone, c.ip)}`);
+    }
+  }
+
+  console.log('');
+  if (alienTotal > 0) {
+    // Say what will HAPPEN, not merely what was found — the answer differs by
+    // whether celilo has a baseline for the box, and that is the thing an
+    // operator most needs to know before the next converge.
+    const consequence = [
+      'On a firewall celilo has not yet converged cleanly, the next converge will REFUSE and change nothing.',
+      'On one with a recorded baseline, an interface that appeared since will be isolated.',
+      'Resolve either by declaring a zone: celilo system config set network.<zone>.subnet <cidr>',
+    ].join('\n');
+    console.log(`${alienTotal} interface(s) celilo cannot attribute.\n${consequence}`);
+  }
+
+  return {
+    success: true,
+    message: alienTotal === 0 ? 'every interface accounted for' : `${alienTotal} unaccounted`,
+  };
+}

package/src/cli/commands/machine-add.ts

@@ -6,6 +6,7 @@
 import { existsSync } from 'node:fs';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { isPubliclyRoutable } from '@celilo/capabilities';
 import { getDb } from '../../db/client';
 import type { NetworkZone } from '../../db/schema';
 import { askText, withInterviewSession } from '../../services/bus-interview';
@@ -16,6 +17,7 @@ import {
   detectNetworkInterfacesLocal,
   testSshConnection,
 } from '../../services/machine-detector';
+import { describeInterfaceZone } from '../../services/machine-detector';
 import { addMachine, getMachineByIp } from '../../services/machine-pool';
 import { loadExistingConfiguration } from '../../services/system-init';
 import { detectZoneFromIp } from '../../services/zone-detector';
@@ -242,8 +244,34 @@ export async function handleMachineAdd(
         console.log(`  Disk: ${detectedInfo.hardware.disk_gb} GB\n`);
 
         // Zone: explicit override, else infer from IP.
+        //
+        // `detectZoneFromIp` answers containment only, and now says `'unknown'`
+        // rather than claiming `external` when nothing matches. Resolving that
+        // is a SECOND question — is this address one the internet can route to?
+        // — and the two were conflated before, which is how a private address in
+        // no declared subnet got labelled as facing the internet.
         console.log('Detecting network zone...');
-        zone = zoneOverride ?? (await detectZoneFromIp(ipAddress));
+        if (zoneOverride) {
+          zone = zoneOverride;
+        } else {
+          const detected = await detectZoneFromIp(ipAddress);
+          if (detected !== 'unknown') {
+            zone = detected;
+          } else if (isPubliclyRoutable(ipAddress)) {
+            // No declared subnet contains it and the internet can route to it:
+            // that is what `external` means — a cloud/VPS box.
+            zone = 'external';
+          } else {
+            // A private address in no declared subnet is UN-ZONEABLE, not
+            // external. Guessing here is the original defect; ask instead.
+            const fix =
+              'Fix: pass --zone <zone>, or declare the subnet with `celilo system config set network.<zone>.subnet <cidr>` and retry.';
+            return {
+              success: false,
+              error: `Cannot infer a zone for ${ipAddress}: it is not publicly routable and no declared network.<zone>.subnet contains it.\n${fix}`,
+            };
+          }
+        }
         console.log(`✓ Zone: ${zone}\n`);
 
         // Detect network interfaces and classify machine
@@ -254,7 +282,7 @@ export async function handleMachineAdd(
 
         console.log(`✓ Role: ${role}`);
         for (const iface of interfaces) {
-          console.log(`  ${iface.name}: ${iface.ipAddress} (${iface.zone})`);
+          console.log(`  ${iface.name}: ${iface.ipAddress} (${describeInterfaceZone(iface)})`);
         }
         console.log('');
       }

package/src/cli/commands/module-config.test.ts

@@ -14,7 +14,9 @@ import { modules } from '../../db/schema';
 import { resolveDeployPosture } from '../../services/deploy-posture';
 import {
   FRAMEWORK_CONFIG_KEYS,
+  handleModuleConfigGet,
   handleModuleConfigSet,
+  handleModuleConfigUnset,
   validateFrameworkConfigValue,
 } from './module-config';
 import { pickUpgradePolicy } from './module-upgrade';
@@ -55,7 +57,12 @@ describe('handleModuleConfigSet — infra-key contract (ISS-0069)', () => {
     const result = await handleModuleConfigSet(['testmod', 'vmid', '203']);
     expect(result.success).toBe(false);
     if (!result.success) {
-      expect(result.error).toContain('infrastructure-managed');
+      // The refusal now names the source rather than a bespoke
+      // "infrastructure-managed" phrase, because `infrastructure` stopped being
+      // the only refused source — every non-`user` source is refused, and each
+      // gets guidance aimed at its own upstream.
+      expect(result.error).toContain('derived by celilo (source: infrastructure)');
+      expect(result.error).toContain('not operator-settable');
     }
   });
 
@@ -112,6 +119,30 @@ describe('handleModuleConfigSet — infra-key contract (ISS-0069)', () => {
     expect(result.success).toBe(false);
   });
 
+  test('a per-module policy key is settable on a module whose manifest never mentions it', async () => {
+    expect((await handleModuleConfigSet(['testmod', 'backup_schedule', '6h'])).success).toBe(true);
+    const read = await handleModuleConfigGet(['testmod', 'backup_schedule']);
+    expect(read.success).toBe(true);
+    if (read.success) expect(read.message).toContain('6h');
+  });
+
+  test('unset removes the override so the module follows its manifest again', async () => {
+    await handleModuleConfigSet(['testmod', 'backup_schedule', 'weekly']);
+
+    const unset = await handleModuleConfigUnset(['testmod', 'backup_schedule']);
+    expect(unset.success).toBe(true);
+
+    expect((await handleModuleConfigGet(['testmod', 'backup_schedule'])).success).toBe(false);
+  });
+
+  test('unsetting a key that was never set reports it and still succeeds', async () => {
+    // `unset` states a desired end state. Failing on an already-clean one makes
+    // it unusable from any script that cannot check first.
+    const result = await handleModuleConfigUnset(['testmod', 'backup_schedule']);
+    expect(result.success).toBe(true);
+    if (result.success) expect(result.message).toContain('No override set');
+  });
+
   test('the valid-keys hint advertises the celilo-managed keys', async () => {
     const result = await handleModuleConfigSet(['testmod', 'nope', 'x']);
     expect(result.success).toBe(false);
@@ -127,8 +158,19 @@ describe('validateFrameworkConfigValue (pure)', () => {
     expect(validateFrameworkConfigValue('app_port', 'anything')).toBeNull();
   });
 
-  test('accepts every documented value', () => {
-    for (const [key, values] of Object.entries(FRAMEWORK_CONFIG_KEYS)) {
+  test('every framework key accepts at least its documented values', () => {
+    const documented: Record<string, string[]> = {
+      auto_upgrade: ['true', 'false'],
+      upgrade_policy: ['by-semver', 'always-safe', 'always-fast'],
+      backup_schedule: ['hourly', 'daily', 'weekly', 'monthly', 'manual', '6h'],
+      health_check_interval: ['15m', '1h', 'daily', 'manual'],
+      backup_retention_count: ['1', '3', '30'],
+      backup_retention_max_age_days: ['1', '30', '365'],
+    };
+    // Every key must be covered, so adding one without deciding what it accepts
+    // fails here rather than shipping unvalidated.
+    expect(Object.keys(documented).sort()).toEqual(Object.keys(FRAMEWORK_CONFIG_KEYS).sort());
+    for (const [key, values] of Object.entries(documented)) {
       for (const v of values) expect(validateFrameworkConfigValue(key, v)).toBeNull();
     }
   });
@@ -136,6 +178,31 @@ describe('validateFrameworkConfigValue (pure)', () => {
   test('rejects an unlisted value', () => {
     expect(validateFrameworkConfigValue('upgrade_policy', 'always_safe')).toContain('Allowed');
   });
+
+  test('rejects a cadence the sweep that would serve it cannot run', () => {
+    // The backup sweep rides an hourly tick; accepting `5m` would leave the
+    // operator believing they configured something that can never happen.
+    expect(validateFrameworkConfigValue('backup_schedule', '5m')).toContain('hourly');
+    // The alerting sweep ticks every five minutes, so the same value is fine there.
+    expect(validateFrameworkConfigValue('health_check_interval', '5m')).toBeNull();
+    expect(validateFrameworkConfigValue('health_check_interval', '1m')).toContain('Allowed');
+  });
+
+  test('a retention of zero or below is refused rather than read as "keep nothing"', () => {
+    // A `0` read as a bound would delete every backup the module has.
+    for (const bad of ['0', '-1', '2.5', 'lots']) {
+      expect(validateFrameworkConfigValue('backup_retention_count', bad)).toContain('1 or greater');
+      expect(validateFrameworkConfigValue('backup_retention_max_age_days', bad)).toContain(
+        '1 or greater',
+      );
+    }
+  });
+
+  test('a misspelled cadence is refused, and says it was not coerced', () => {
+    const error = validateFrameworkConfigValue('backup_schedule', 'dailyy');
+    expect(error).toContain('named period');
+    expect(error).toContain('Rejected rather than coerced');
+  });
 });
 
 // The point of the whole control: with always-safe set, a PATCH upgrade — which

package/src/cli/commands/module-config.ts

@@ -3,14 +3,38 @@
  */
 
 import { eq } from 'drizzle-orm';
+import { z } from 'zod';
 import { getDb } from '../../db/client';
 import { modules } from '../../db/schema';
+import type { ModuleManifest, VariableDeclare } from '../../manifest/schema';
 import {
+  HEALTH_CHECK_INTERVAL_CONFIG_KEY,
+  reconcileModuleWatchState,
+} from '../../services/alerting/health-cadence';
+import {
+  BACKUP_RETENTION_COUNT_CONFIG_KEY,
+  BACKUP_RETENTION_MAX_AGE_DAYS_CONFIG_KEY,
+} from '../../services/backup-retention';
+import { BACKUP_SCHEDULE_CONFIG_KEY } from '../../services/backup-schedule';
+import {
+  BACKUP_CADENCE_FLOOR_MINUTES,
+  MONITOR_INTERVAL_FLOOR_MINUTES,
+  cadenceSchema,
+} from '../../services/cadence';
+import {
+  declaredVariables,
+  describeDerivedSource,
+  explainNotSettable,
+  isDerivedVariable,
+} from '../../services/config-provenance';
+import {
+  deleteModuleConfig,
   formatConfigValue,
   getAllModuleConfigValues,
   getModuleConfigValue,
   setModuleConfigValue,
 } from '../../services/module-config';
+import { readResolutionContext } from '../../variables/context';
 import { getArg, validateRequiredArgs } from '../parser';
 import type { CommandResult } from '../types';
 
@@ -18,6 +42,12 @@ import type { CommandResult } from '../types';
  * Operator keys that EVERY module accepts, whether or not its manifest declares
  * them, with their permitted values.
  *
+ * This is also where a module's per-module POLICY lives: how often to back it
+ * up, how often to health-check it. A manifest states those as the author's
+ * suggestion about a fleet they have never seen; the row an operator writes
+ * here wins, and every reader resolves the two at read time so a corrected
+ * manifest still reaches installs that have not overridden it.
+ *
  * These describe how celilo TREATS a module (its CD policy), not how the module
  * configures itself, so gating them on `variables.owns` had it backwards: it
  * required each module author to opt into being manageable. The failure was
@@ -34,9 +64,69 @@ import type { CommandResult } from '../types';
  * floor while nothing changed. A safety control that fails open on a typo is
  * worse than no control.
  */
-export const FRAMEWORK_CONFIG_KEYS: Record<string, readonly string[]> = {
-  auto_upgrade: ['true', 'false'],
-  upgrade_policy: ['by-semver', 'always-safe', 'always-fast'],
+export interface FrameworkConfigKey {
+  /** Accepts the value the operator typed, or explains what it should be. */
+  schema: z.ZodTypeAny;
+  /**
+   * Why this key is refused rather than coerced. Carried per key rather than
+   * derived from the schema's error: the substance is what a WRONG value would
+   * silently do, and no validator knows that.
+   */
+  why: string;
+}
+
+const REFUSED_NOT_COERCED_UPGRADE =
+  'Rejected rather than coerced: an unrecognized value silently falls back to the PERMISSIVE default (upgrade_policy → by-semver, which skips the pre-deploy backup on a patch), so a typo would look like it took effect.';
+
+const REFUSED_NOT_COERCED_CADENCE =
+  'Rejected rather than coerced: an unrecognized cadence falls back to the manifest\'s suggestion, so a typo would leave the module on the cadence you meant to change — visibly "set", and doing nothing.';
+
+const REFUSED_NOT_COERCED_RETENTION =
+  'Rejected rather than coerced: an unrecognized retention value falls back to the manifest, so a typo would leave the module keeping a different number of backups than you asked for — and the direction that goes wrong deletes data.';
+
+/** An enum whose rejection message reads as an operator instruction, not a type error. */
+function oneOf(values: readonly [string, ...string[]]): z.ZodTypeAny {
+  return z.enum(values, { errorMap: () => ({ message: `Allowed: ${values.join(', ')}` }) });
+}
+
+/**
+ * A whole number of things, at least one. Zero is refused rather than read as
+ * "keep nothing": a retention of 0 would delete every backup the module has.
+ */
+function positiveInteger(what: string): z.ZodTypeAny {
+  return z.string().superRefine((value, ctx) => {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `Allowed: a whole number of ${what}, 1 or greater. Unset the key to keep everything.`,
+      });
+    }
+  });
+}
+
+export const FRAMEWORK_CONFIG_KEYS: Record<string, FrameworkConfigKey> = {
+  auto_upgrade: { schema: oneOf(['true', 'false']), why: REFUSED_NOT_COERCED_UPGRADE },
+  upgrade_policy: {
+    schema: oneOf(['by-semver', 'always-safe', 'always-fast']),
+    why: REFUSED_NOT_COERCED_UPGRADE,
+  },
+  [BACKUP_SCHEDULE_CONFIG_KEY]: {
+    schema: cadenceSchema({ floorMinutes: BACKUP_CADENCE_FLOOR_MINUTES }),
+    why: REFUSED_NOT_COERCED_CADENCE,
+  },
+  [HEALTH_CHECK_INTERVAL_CONFIG_KEY]: {
+    schema: cadenceSchema({ floorMinutes: MONITOR_INTERVAL_FLOOR_MINUTES }),
+    why: REFUSED_NOT_COERCED_CADENCE,
+  },
+  [BACKUP_RETENTION_COUNT_CONFIG_KEY]: {
+    schema: positiveInteger('copies to keep'),
+    why: REFUSED_NOT_COERCED_RETENTION,
+  },
+  [BACKUP_RETENTION_MAX_AGE_DAYS_CONFIG_KEY]: {
+    schema: positiveInteger('days to keep a backup'),
+    why: REFUSED_NOT_COERCED_RETENTION,
+  },
 };
 
 /**
@@ -44,10 +134,12 @@ export const FRAMEWORK_CONFIG_KEYS: Record<string, readonly string[]> = {
  * or null when the key is not a framework key or the value is permitted.
  */
 export function validateFrameworkConfigValue(key: string, value: string): string | null {
-  const allowed = FRAMEWORK_CONFIG_KEYS[key];
-  if (!allowed) return null;
-  if (allowed.includes(value)) return null;
-  return `Invalid value '${value}' for '${key}'.\n\nAllowed: ${allowed.join(', ')}\n\nRejected rather than coerced: an unrecognized value silently falls back to the PERMISSIVE default (upgrade_policy → by-semver, which skips the pre-deploy backup on a patch), so a typo would look like it took effect.`;
+  const framework = FRAMEWORK_CONFIG_KEYS[key];
+  if (!framework) return null;
+  const result = framework.schema.safeParse(value);
+  if (result.success) return null;
+  const explanation = result.error.issues.map((issue) => issue.message).join('\n');
+  return `Invalid value '${value}' for '${key}'.\n\n${explanation}\n\n${framework.why}`;
 }
 
 /**
@@ -96,17 +188,14 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
   const isFrameworkKey = key in FRAMEWORK_CONFIG_KEYS;
 
   // Validate key against manifest
-  const manifest = module.manifestData as Record<string, unknown>;
-  const variables = manifest.variables as
-    | { owns?: Array<{ name: string; required?: boolean; default?: string; source?: string }> }
-    | undefined;
-  const declaredVars = variables?.owns || [];
+  const manifest = module.manifestData as ModuleManifest;
+  const declaredVars = manifest.variables?.owns ?? [];
 
   // Check if key is declared in manifest
   const declaredVar = declaredVars.find((v) => v.name === key);
   if (!declaredVar && !isFrameworkKey) {
     const settableKeys = declaredVars
-      .filter((v) => v.source !== 'infrastructure')
+      .filter((v) => !isDerivedVariable(v))
       .map((v) => v.name)
       .join(', ');
     const frameworkKeys = Object.keys(FRAMEWORK_CONFIG_KEYS).join(', ');
@@ -116,25 +205,37 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
     };
   }
 
-  // ISS-0069: reject infrastructure-managed keys at SET time rather than
-  // accepting-then-silently-overriding them at deploy. `source: infrastructure`
-  // variables (vmid, target_ip, target_node, gateway, vlan, lxc_template) are
-  // derived by the deploy (IPAM allocates vmid/IP; the container service supplies
-  // node/template/gateway/vlan), so a value set here would be ignored.
-  if (declaredVar?.source === 'infrastructure') {
+  // Refuse EVERY derived source, not just `infrastructure`.
+  //
+  // ISS-0069 established the principle — refuse at SET time rather than
+  // accepting-then-silently-overriding at deploy — and then applied it to one
+  // source out of four. So `celilo module config set authentik auth_url …`
+  // (a `capability`-sourced value) reported success, wrote the row, and was
+  // discarded on the next deploy. A command that says "Set config for authentik"
+  // and changes nothing is worse than one that refuses.
+  //
+  // No counter-example survived review of a good reason to pin a derived value:
+  // a derived value computes the right answer from one source of truth, so if
+  // the answer is wrong the source is wrong, and fixing the source fixes every
+  // consumer at once while pinning one module hides the divergence.
+  if (declaredVar && isDerivedVariable(declaredVar)) {
     return {
       success: false,
-      error: `'${key}' is infrastructure-managed by celilo (source: infrastructure) — not operator-settable.\nThe deploy derives it automatically, so a value set here would be silently ignored.\n  • node placement: set the service default for NEW deploys (celilo service reconfigure); move an existing container with 'celilo proxmox migrate' (ISS-0062).\n  • vmid / IP: auto-allocated by IPAM.`,
+      error: explainNotSettable(moduleId, declaredVar),
     };
   }
 
   // Set config value using service (handles primitive and complex types)
   try {
     await setModuleConfigValue(moduleId, key, value);
+    const resolved = settlingWatchState(db, moduleId, key);
 
     return {
       success: true,
-      message: `Set config for ${moduleId}: ${key}`,
+      message:
+        resolved > 0
+          ? `Set config for ${moduleId}: ${key} (resolved ${resolved} alert(s) — nothing will report on this module again until it is watched)`
+          : `Set config for ${moduleId}: ${key}`,
     };
   } catch (error) {
     return {
@@ -144,6 +245,69 @@ export async function handleModuleConfigSet(args: string[]): Promise<CommandResu
   }
 }
 
+/**
+ * Handle module config unset command
+ *
+ * Usage: celilo module config unset <module-id> <key>
+ *
+ * Removing an override is what returns a module to following its manifest.
+ * Without it, an operator who once set a cadence could never go back to the
+ * author's suggestion, and every later correction would stop reaching them —
+ * the exact failure read-time resolution exists to prevent, aimed at the
+ * operators who engaged with the feature.
+ *
+ * @param args - Command arguments
+ * @returns Command result
+ */
+export async function handleModuleConfigUnset(args: string[]): Promise<CommandResult> {
+  const error = validateRequiredArgs(args, 2);
+  if (error) {
+    return {
+      success: false,
+      error: `${error}\n\nUsage: celilo module config unset <module-id> <key>`,
+    };
+  }
+
+  const moduleId = getArg(args, 0);
+  const key = getArg(args, 1);
+
+  if (!moduleId || !key) {
+    return { success: false, error: 'Module ID and key are required' };
+  }
+
+  const db = getDb();
+
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) {
+    return { success: false, error: `Module not found: ${moduleId}` };
+  }
+
+  // Unsetting a key that was never set SUCCEEDS. `unset` states a desired end
+  // state, and failing on an already-clean one makes it unusable from any
+  // script that cannot check first.
+  if (!getModuleConfigValue(moduleId, key, db)) {
+    return { success: true, message: `No override set for ${moduleId}: ${key}` };
+  }
+
+  deleteModuleConfig(db, moduleId, key);
+  settlingWatchState(db, moduleId, key);
+  return {
+    success: true,
+    message: `Unset config for ${moduleId}: ${key} (now follows the module's manifest)`,
+  };
+}
+
+/**
+ * A module that has just stopped being watched may still own live alerts from
+ * its last scheduled runs, and nothing will ever report on them again. Resolve
+ * them here rather than leaving them firing with no action able to clear them.
+ * No-op for every other key.
+ */
+function settlingWatchState(db: ReturnType<typeof getDb>, moduleId: string, key: string): number {
+  if (key !== HEALTH_CHECK_INTERVAL_CONFIG_KEY) return 0;
+  return reconcileModuleWatchState(db, moduleId, new Date());
+}
+
 /**
  * Handle module config get command
  *
@@ -203,10 +367,24 @@ export async function handleModuleConfigGet(args: string[]): Promise<CommandResu
     };
   }
 
-  // Get all config for module
-  const configs = getAllModuleConfigValues(moduleId);
+  // Get all config for module, split by who owns each value.
+  //
+  // Printing every row flat presented a value celilo computed as if the
+  // operator had chosen it, which is how a derived value gets "corrected" by
+  // hand and silently reverted. The derived section is also read from the
+  // resolution context rather than the config rows, so it shows what celilo
+  // computes RIGHT NOW — including values that were never written down, the
+  // absence that caused the 2026-08-14 DNS outage.
+  const declared = declaredVariables(module.manifestData as ModuleManifest);
+  const stored = getAllModuleConfigValues(moduleId);
+  const userConfigs = stored.filter((c) => {
+    const variable = declared.get(c.key);
+    return !variable || !isDerivedVariable(variable);
+  });
+
+  const derivedValues = await resolveDerivedForDisplay(moduleId, declared, db);
 
-  if (configs.length === 0) {
+  if (userConfigs.length === 0 && derivedValues.length === 0) {
     return {
       success: true,
       message: `No configuration set for ${moduleId}`,
@@ -214,14 +392,70 @@ export async function handleModuleConfigGet(args: string[]): Promise<CommandResu
   }
 
   const lines = [`Configuration for ${moduleId}:`, ''];
-  for (const config of configs) {
-    const formatted = formatConfigValue(config);
-    lines.push(`${config.key} = ${formatted}`);
+  if (userConfigs.length > 0) {
+    for (const config of userConfigs) {
+      lines.push(`${config.key} = ${formatConfigValue(config)}`);
+    }
+  } else {
+    lines.push('(nothing set by you)');
+  }
+
+  if (derivedValues.length > 0) {
+    lines.push('', 'Derived by celilo (not settable — fix the source instead):', '');
+    for (const derived of derivedValues) {
+      lines.push(`${derived.key} = ${derived.value}`);
+      lines.push(`    ${describeDerivedSource(derived.variable)}`);
+    }
   }
 
   return {
     success: true,
     message: lines.join('\n'),
-    data: configs.map((c) => ({ key: c.key, value: c.value })),
+    data: {
+      config: userConfigs.map((c) => ({ key: c.key, value: c.value })),
+      derived: derivedValues.map((d) => ({
+        key: d.key,
+        value: d.value,
+        source: d.variable.source,
+      })),
+    },
   };
 }
+
+/**
+ * The current value of each derived variable, for display only.
+ *
+ * Uses the side-effect-free resolution context: reading a config must not seed
+ * rows or allocate addresses. A module whose derives cannot resolve yet (an
+ * undeployed provider, an unset system key) reports nothing derived rather than
+ * failing the whole command — `get` is how an operator diagnoses that state, so
+ * it has to survive it.
+ */
+async function resolveDerivedForDisplay(
+  moduleId: string,
+  declared: Map<string, VariableDeclare>,
+  db: ReturnType<typeof getDb>,
+): Promise<Array<{ key: string; value: string; variable: VariableDeclare }>> {
+  const derivedVars = [...declared.values()].filter(isDerivedVariable);
+  if (derivedVars.length === 0) return [];
+
+  let selfConfig: Record<string, string>;
+  try {
+    selfConfig = (await readResolutionContext(moduleId, db)).selfConfig;
+  } catch {
+    // Reported as "not computed yet" below rather than as an error, so the
+    // command still shows the operator their own config.
+    return [];
+  }
+
+  const resolved: Array<{ key: string; value: string; variable: VariableDeclare }> = [];
+  for (const variable of derivedVars) {
+    const value = selfConfig[variable.name];
+    resolved.push({
+      key: variable.name,
+      value: value ?? '(not computed yet)',
+      variable,
+    });
+  }
+  return resolved;
+}