@celilo/cli 0.26.1 → 1.0.0

package/src/services/module-deploy.ts

@@ -59,38 +59,18 @@ export interface DeployResult {
   };
 }
 
-/**
- * Update machine's assigned module IDs after successful deployment
- * Execution function - updates database
- *
- * @param moduleId - Module identifier
- * @param machineId - Machine identifier
- * @param db - Database connection
- */
-async function updateMachineAssignment(
-  moduleId: string,
-  machineId: string,
-  db: DbClient,
-): Promise<void> {
-  // Get current machine record
-  const machine = await db.select().from(machines).where(eq(machines.id, machineId)).get();
-
-  if (!machine) {
-    throw new Error(`Machine not found: ${machineId}`);
-  }
-
-  // Add module ID if not already assigned
-  const assignedIds = machine.assignedModuleIds || [];
-  if (!assignedIds.includes(moduleId)) {
-    const updatedIds = [...assignedIds, moduleId];
-    await db
-      .update(machines)
-      .set({ assignedModuleIds: updatedIds })
-      .where(eq(machines.id, machineId))
-      .run();
-    log.success(`Machine ${machineId} updated with module assignment`);
-  }
-}
+// `updateMachineAssignment` is deleted (celilo#773).
+//
+// It was the sole writer of `machines.assigned_module_ids`, it only ever
+// APPENDED, and nothing ever removed an entry — `module remove` deletes the
+// module row and never touches `machines`. So a machine accumulated the ids of
+// modules that no longer existed and could never be freed except by editing the
+// database.
+//
+// Nothing replaces it. Occupancy is now derived from `module_infrastructure`
+// and `module_systems` at the point of use (`getModulesOnMachine`), both of
+// which the deploy path already writes and both of which cascade on module
+// removal — so the machine frees itself with no bookkeeping step to forget.
 
 export interface DeployOptions {
   debug?: boolean;
@@ -1203,13 +1183,11 @@ async function deployModuleImpl(
         };
       }
 
-      if (plan.infrastructure?.type === 'machine' && plan.infrastructure.machineId) {
-        // Update machine's assigned_module_ids
-        await updateMachineAssignment(moduleId, plan.infrastructure.machineId, db);
-      } else if (
-        plan.infrastructure?.type === 'container_service' &&
-        plan.infrastructure.serviceId
-      ) {
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
+        // Placeholder branch retained below; the machine branch is gone because
+        // occupancy is no longer a stored fact to update (celilo#773).
+      }
+      if (plan.infrastructure?.type === 'container_service' && plan.infrastructure.serviceId) {
         // TODO: extract Terraform outputs and persist them on
         // module_infrastructure.containerMetadata. Until that lands,
         // the deploy still succeeds — we just don't track which

package/src/services/module-validator/index.test.ts

@@ -15,6 +15,15 @@ const REPO_ROOT = resolve(__dirname, '../../../../..');
 const CADDY_MODULE_PATH = resolve(REPO_ROOT, 'modules/caddy');
 
 describe('runChecks (orchestrator)', () => {
+  // celilo#804: this test timed out at 60000ms on a docs-only CI run yet
+  // measures ~500ms end-to-end locally (all 3 tests in this file, combined).
+  // The work here is a handful of synchronous `git`/`spawnSync` calls
+  // (checkGitHygiene) with nothing to cut without dropping the git_hygiene
+  // check this test exists to exercise — so this was a saturated CI runner
+  // stalling those spawns, not this suite sitting close to its budget.
+  // Raising the timeout further wouldn't shrink that margin (a real stall
+  // would blow through any budget); left at the file's default (60000ms,
+  // ~100x the measured runtime) rather than bumped without evidence it helps.
   test('healthy in-tree module produces all-ok report', async () => {
     const checks = await runChecks(CADDY_MODULE_PATH, {
       noBuild: true,

package/src/services/port-forwards.test.ts

@@ -3,11 +3,14 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import type { PortForwardStore } from '@celilo/capabilities';
+import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
+import { portForwards } from '../db/schema';
 import { setupTestDatabase } from '../test-utils/setup-test-db';
-import { buildPortForwardStore } from './port-forwards';
+import { buildPortForwardStore, deletePortForwardsForModule } from './port-forwards';
 
 const FW = '192.168.0.254';
+const CADDY = { internalIp: '10.0.20.5', protocol: 'TCP' as const, description: 'caddy' };
 
 describe('port-forward store', () => {
   let dir: string;
@@ -19,7 +22,7 @@ describe('port-forward store', () => {
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
     db = await setupTestDatabase(dbPath);
-    store = buildPortForwardStore(db);
+    store = buildPortForwardStore(db, 'caddy');
   });
   afterEach(() => {
     db.$client.close();
@@ -31,62 +34,112 @@ describe('port-forward store', () => {
     }
   });
 
-  it('adds and lists forwards for a firewall', () => {
-    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'caddy' });
-    store.add(FW, {
-      internalIp: '10.0.20.42',
-      port: 2222,
-      protocol: 'TCP',
-      description: 'forgejo',
-    });
+  it('declares and lists forwards for a firewall', () => {
+    store.replace(FW, CADDY, [80, 443]);
     const forwards = store.list(FW);
     expect(forwards).toHaveLength(2);
-    expect(forwards.map((f) => f.port).sort((a, b) => a - b)).toEqual([443, 2222]);
+    expect(forwards.map((f) => f.port).sort((a, b) => a - b)).toEqual([80, 443]);
   });
 
-  it('add is an idempotent upsert — same tuple → one row, description updated', () => {
-    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'v1' });
-    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'v2' });
+  it('stamps registeredBy from the bound consumer, and no caller can supply it', () => {
+    store.replace(FW, CADDY, [443]);
+    expect(store.list(FW)[0].registeredBy).toBe('caddy');
+    // The write takes only (firewall, target, ports) — there is no parameter an
+    // owner could be passed through, which is the point rather than an omission.
+    expect(store.replace.length).toBe(3);
+  });
+
+  it('replace is idempotent — same declaration twice → one row per port', () => {
+    store.replace(FW, { ...CADDY, description: 'v1' }, [443]);
+    store.replace(FW, { ...CADDY, description: 'v2' }, [443]);
     const forwards = store.list(FW);
     expect(forwards).toHaveLength(1);
     expect(forwards[0].description).toBe('v2');
   });
 
   it('scopes forwards by firewallIp', () => {
-    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'a' });
-    store.add('10.0.30.254', {
-      internalIp: '10.0.30.5',
-      port: 53,
-      protocol: 'UDP',
-      description: 'b',
-    });
+    store.replace(FW, CADDY, [443]);
+    store.replace(
+      '10.0.30.254',
+      { internalIp: '10.0.30.5', protocol: 'UDP', description: 'b' },
+      [53],
+    );
     expect(store.list(FW)).toHaveLength(1);
     expect(store.list('10.0.30.254')).toHaveLength(1);
   });
 
-  it('remove deletes exactly the tuple and leaves others', () => {
-    store.add(FW, { internalIp: '10.0.20.5', port: 443, protocol: 'TCP', description: 'x' });
-    store.add(FW, { internalIp: '10.0.20.5', port: 80, protocol: 'TCP', description: 'y' });
-    store.remove(FW, '10.0.20.5', 443, 'TCP');
-    const forwards = store.list(FW);
-    expect(forwards).toHaveLength(1);
-    expect(forwards[0].port).toBe(80);
-  });
-
   it('ingressIp forwards are distinct from the public (NULL) ones', () => {
-    store.add(FW, { internalIp: '10.0.20.5', port: 53, protocol: 'UDP', description: 'public' });
-    store.add(FW, {
-      internalIp: '10.0.20.5',
-      port: 53,
-      protocol: 'UDP',
-      ingressIp: '10.0.10.53',
-      description: 'ingress',
-    });
+    const target = { internalIp: '10.0.20.5', protocol: 'UDP' as const, description: 'dns' };
+    store.replace(FW, target, [53]);
+    store.replace(FW, { ...target, ingressIp: '10.0.10.53' }, [53]);
     expect(store.list(FW)).toHaveLength(2);
-    // removing the public (NULL-ingress) one leaves the ingress one intact
-    store.remove(FW, '10.0.20.5', 53, 'UDP');
+    // Re-declaring the public (NULL-ingress) set as empty leaves the ingress one.
+    store.replace(FW, target, []);
     const forwards = store.list(FW);
     expect(forwards).toHaveLength(1);
     expect(forwards[0].ingressIp).toBe('10.0.10.53');
   });
+
+  // D5b / celilo#855. Before this, `exposeService` upserted per port and nothing
+  // ever removed a forward a consumer stopped wanting: a module that exposed
+  // :8080 and redeployed exposing :9090 kept both, forever.
+  it('re-declaring with a shorter port list drops the ports left out', () => {
+    store.replace(FW, CADDY, [80, 443, 8080]);
+    store.replace(FW, CADDY, [80, 443]);
+    expect(
+      store
+        .list(FW)
+        .map((f) => f.port)
+        .sort((a, b) => a - b),
+    ).toEqual([80, 443]);
+  });
+
+  it('a consumer narrowing its declaration withdraws no other module rows', () => {
+    const forgejo = buildPortForwardStore(db, 'forgejo');
+    store.replace(FW, CADDY, [80, 443]);
+    forgejo.replace(FW, { internalIp: '10.0.20.42', protocol: 'TCP', description: 'git' }, [2222]);
+
+    store.replace(FW, CADDY, [443]);
+
+    expect(store.list(FW).filter((f) => f.registeredBy === 'forgejo')).toHaveLength(1);
+  });
+
+  // D5a, the refcount case — the bug most likely to ship silently. The owner is
+  // IN the unique index, so two consumers of the same forward are two rows and
+  // one leaving does not delete a rule the other still needs.
+  it('two consumers of the SAME forward are two rows, and one leaving leaves the other', () => {
+    const other = buildPortForwardStore(db, 'greenwave-app');
+    store.replace(FW, CADDY, [443]);
+    other.replace(FW, { ...CADDY, description: 'also 443' }, [443]);
+    expect(store.list(FW)).toHaveLength(2);
+
+    deletePortForwardsForModule(db, 'caddy');
+
+    const left = store.list(FW);
+    expect(left).toHaveLength(1);
+    expect(left[0].registeredBy).toBe('greenwave-app');
+    expect(left[0].port).toBe(443);
+  });
+
+  // Migration 0025 leaves pre-existing rows with an empty owner so the fleet
+  // keeps serving. They are adopted the first time their owner re-declares the
+  // same target, which is the only moment we can safely say who owns them.
+  it('adopts an unattributed legacy row when its owner re-declares the target', () => {
+    db.insert(portForwards)
+      .values({
+        firewallIp: FW,
+        internalIp: CADDY.internalIp,
+        port: 443,
+        protocol: 'TCP',
+        description: 'legacy',
+        registeredBy: '',
+      })
+      .run();
+
+    store.replace(FW, CADDY, [443]);
+
+    const rows = db.select().from(portForwards).where(eq(portForwards.firewallIp, FW)).all();
+    expect(rows).toHaveLength(1);
+    expect(rows[0].registeredBy).toBe('caddy');
+  });
 });

package/src/services/port-forwards.ts

@@ -2,15 +2,20 @@
  * Port-forward registry — the DB-backed `PortForwardStore` (openspec/changes/unified-management-no-ssh/proposal.md).
  *
  * The shared-core desired-state store for the `firewall` capability. The
- * capability-loader constructs one of these and injects it into the firewall
- * provider factory, so `exposeService`/`unexposeService` become register/
- * unregister and the provider's converge renders the complete ruleset from
- * `list(firewallIp)` and applies it atomically (`iptables-restore`). Replaces
- * "read the box back with `iptables -L`" as the source of truth.
+ * capability-loader constructs one of these bound to the CONSUMING module and
+ * injects it into the firewall provider factory, so `exposeService` becomes a
+ * declaration of that consumer's complete port set and the provider's converge
+ * renders the whole ruleset from `list(firewallIp)`, applying it atomically
+ * (`iptables-restore`). Replaces "read the box back with `iptables -L`" as the
+ * source of truth.
+ *
+ * `registeredBy` is stamped HERE, never accepted from a caller — the same rule
+ * `buildTrustedSourceStore` follows, so a forward cannot be attributed to the
+ * wrong module (openspec/changes/consumer-removal-cleanup, D2).
  */
 
-import type { PortForward, PortForwardStore, Protocol } from '@celilo/capabilities';
-import { and, eq, isNull } from 'drizzle-orm';
+import type { PortForward, PortForwardStore, PortForwardTarget } from '@celilo/capabilities';
+import { and, eq, isNull, or } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { portForwards } from '../db/schema';
 
@@ -19,7 +24,37 @@ function ingressMatch(ingressIp: string | undefined) {
   return ingressIp ? eq(portForwards.ingressIp, ingressIp) : isNull(portForwards.ingressIp);
 }
 
-export function buildPortForwardStore(db: DbClient): PortForwardStore {
+/**
+ * Every row this consumer owns for one target, plus the UNATTRIBUTED rows for
+ * the same target.
+ *
+ * The unattributed half is the migration's other end: rows written before
+ * `registered_by` existed carry `''`, and a consumer re-declaring the target
+ * they describe is the one moment we can safely say who owns them — one module
+ * owns a backend IP. Without this they would render forever with no owner to
+ * withdraw them.
+ */
+function ownedOrUnattributed(firewallIp: string, target: PortForwardTarget, consumer: string) {
+  return and(
+    eq(portForwards.firewallIp, firewallIp),
+    eq(portForwards.internalIp, target.internalIp),
+    eq(portForwards.protocol, target.protocol),
+    ingressMatch(target.ingressIp),
+    or(eq(portForwards.registeredBy, consumer), eq(portForwards.registeredBy, '')),
+  );
+}
+
+/**
+ * Build the store bound to the module that will call through the capability.
+ *
+ * ponytail: a consumer that stops exposing a target ENTIRELY — its backend IP
+ * changes, or it drops a host — leaves rows for the old target, because no call
+ * arrives to declare that target's set empty. Bounded: the rows die when the
+ * module is removed, and a redeploy onto a new host is the only way to reach
+ * it. Closing it needs a sweep against `getModuleSystems`, which is not
+ * obviously worth its own failure mode.
+ */
+export function buildPortForwardStore(db: DbClient, registeredBy: string): PortForwardStore {
   return {
     list(firewallIp: string): PortForward[] {
       return db
@@ -33,54 +68,45 @@ export function buildPortForwardStore(db: DbClient): PortForwardStore {
           protocol: r.protocol,
           ingressIp: r.ingressIp ?? undefined,
           description: r.description,
+          registeredBy: r.registeredBy,
         }));
     },
 
-    add(firewallIp: string, forward: PortForward): void {
-      // Idempotent upsert: delete any existing row for this exact tuple, then
-      // insert. Matches buildRouteOps' delete-then-insert (keeps the operation
-      // atomic w.r.t. the unique index, and NULL-aware on ingress_ip).
+    replace(firewallIp: string, target: PortForwardTarget, ports: number[]): void {
+      // Delete-then-insert over the consumer's WHOLE set for this target, not
+      // per port: that is what makes a redeploy exposing a shorter port list
+      // withdraw the ports it left out (celilo#855). Scoped to this consumer,
+      // so another module's forward for the same target is untouched.
       db.delete(portForwards)
-        .where(
-          and(
-            eq(portForwards.firewallIp, firewallIp),
-            eq(portForwards.internalIp, forward.internalIp),
-            eq(portForwards.port, forward.port),
-            eq(portForwards.protocol, forward.protocol),
-            ingressMatch(forward.ingressIp),
-          ),
-        )
+        .where(ownedOrUnattributed(firewallIp, target, registeredBy))
         .run();
-      db.insert(portForwards)
-        .values({
-          firewallIp,
-          internalIp: forward.internalIp,
-          port: forward.port,
-          protocol: forward.protocol,
-          ingressIp: forward.ingressIp ?? null,
-          description: forward.description,
-        })
-        .run();
-    },
 
-    remove(
-      firewallIp: string,
-      internalIp: string,
-      port: number,
-      protocol: Protocol,
-      ingressIp?: string,
-    ): void {
-      db.delete(portForwards)
-        .where(
-          and(
-            eq(portForwards.firewallIp, firewallIp),
-            eq(portForwards.internalIp, internalIp),
-            eq(portForwards.port, port),
-            eq(portForwards.protocol, protocol),
-            ingressMatch(ingressIp),
-          ),
+      if (ports.length === 0) return;
+
+      db.insert(portForwards)
+        .values(
+          ports.map((port) => ({
+            firewallIp,
+            internalIp: target.internalIp,
+            port,
+            protocol: target.protocol,
+            ingressIp: target.ingressIp ?? null,
+            description: target.description,
+            registeredBy,
+          })),
         )
         .run();
     },
   };
 }
+
+/**
+ * Drop every forward a departing module owns, across every firewall.
+ *
+ * `registered_by` is plain text rather than a FK, so unlike `web_routes` these
+ * rows do NOT die with the `modules` row — core deletes them explicitly, AFTER
+ * the provider has converged without them (D4).
+ */
+export function deletePortForwardsForModule(db: DbClient, moduleId: string): void {
+  db.delete(portForwards).where(eq(portForwards.registeredBy, moduleId)).run();
+}

package/src/services/ssh-key-manager.test.ts

@@ -55,7 +55,6 @@ describe('a machine with no stored SSH key fails loudly, not silently', () => {
       hardware: { cpu_cores: 4, memory_mb: 4096, disk_gb: 100 },
       role: 'host',
       interfaces: [],
-      assignedModuleIds: [],
     });
 
     await expect(writeTemporarySshKey(machine.id)).rejects.toThrow(/has no SSH key stored/);
@@ -114,7 +113,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -142,7 +140,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -163,7 +160,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath = await writeTemporarySshKey(machine.id);
@@ -189,7 +185,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const machine2 = await addMachine({
@@ -201,7 +196,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const keyPath1 = await writeTemporarySshKey(machine1.id);
@@ -232,7 +226,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -252,7 +245,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -274,7 +266,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);
@@ -301,7 +292,6 @@ describe('ssh-key-manager', () => {
         hardware: { cpu_cores: 2, memory_mb: 2048, disk_gb: 20 },
         role: 'host',
         interfaces: [],
-        assignedModuleIds: [],
       });
 
       const managedKey = new ManagedSshKey(machine.id);

package/src/services/trusted-sources.test.ts

@@ -40,27 +40,63 @@ describe('trusted-source store', () => {
 
   it('stamps registeredBy from the binding, not the caller', () => {
     const store = buildTrustedSourceStore(db, 'wireguard');
-    store.add(FW, { subnet: VPN, description: 'admin VPN clients' });
+    store.replace(FW, { subnets: [VPN], description: 'admin VPN clients' });
 
     expect(store.list(FW)).toEqual([
       { subnet: VPN, description: 'admin VPN clients', registeredBy: 'wireguard' },
     ]);
   });
 
-  it('upserts by subnet — registering twice yields one row', () => {
+  it('replace is idempotent — declaring the same set twice yields one row', () => {
     const store = buildTrustedSourceStore(db, 'wireguard');
-    store.add(FW, { subnet: VPN, description: 'first' });
-    store.add(FW, { subnet: VPN, description: 'second' });
+    store.replace(FW, { subnets: [VPN], description: 'first' });
+    store.replace(FW, { subnets: [VPN], description: 'second' });
 
     expect(store.list(FW)).toHaveLength(1);
     expect(store.list(FW)[0].description).toBe('second');
   });
 
-  it('removes by subnet and leaves other firewalls alone', () => {
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
-    buildTrustedSourceStore(db, 'other').add('10.0.0.1', { subnet: VPN, description: 'elsewhere' });
+  // D5b: the set is DECLARED, so changing an admin VPN's client subnet revokes
+  // the old one's reach. It used to keep reaching every zone forever.
+  it('a subnet left out of a later declaration loses its reach', () => {
+    const store = buildTrustedSourceStore(db, 'wireguard');
+    store.replace(FW, { subnets: [VPN, '10.9.9.0/24'], description: 'vpn' });
+    store.replace(FW, { subnets: [VPN], description: 'vpn' });
 
-    buildTrustedSourceStore(db, 'wireguard').remove(FW, VPN);
+    expect(store.list(FW).map((s) => s.subnet)).toEqual([VPN]);
+  });
+
+  it('an empty declaration withdraws the consumer’s whole set', () => {
+    const store = buildTrustedSourceStore(db, 'wireguard');
+    store.replace(FW, { subnets: [VPN], description: 'vpn' });
+    store.replace(FW, { subnets: [], description: 'vpn' });
+
+    expect(store.list(FW)).toEqual([]);
+  });
+
+  // D5a, the refcount case: the owner is in the unique index, so two modules
+  // trusting the same subnet are two rows and one withdrawing does not revoke
+  // the other's reach.
+  it('two consumers trusting the same subnet are two rows; one withdrawing leaves the other', () => {
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace(FW, { subnets: [VPN], description: 'also vpn' });
+    expect(listTrustedSourcesFor(db, FW)).toHaveLength(2);
+
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [], description: 'vpn' });
+
+    expect(listTrustedSourcesFor(db, FW)).toEqual([
+      { subnet: VPN, description: 'also vpn', registeredBy: 'other' },
+    ]);
+  });
+
+  it('withdrawing on one firewall leaves other firewalls alone', () => {
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace('10.0.0.1', {
+      subnets: [VPN],
+      description: 'elsewhere',
+    });
+
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [], description: 'vpn' });
 
     expect(buildTrustedSourceStore(db, 'wireguard').list(FW)).toEqual([]);
     expect(buildTrustedSourceStore(db, 'other').list('10.0.0.1')).toHaveLength(1);
@@ -69,9 +105,9 @@ describe('trusted-source store', () => {
   it('reads one firewall’s registrations without a module binding', () => {
     // Trust registered against one firewall is not trust granted by another —
     // the read is scoped, and the reader needs no identity to look.
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
-    buildTrustedSourceStore(db, 'other').add('10.0.0.1', {
-      subnet: '172.16.9.0/24',
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
+    buildTrustedSourceStore(db, 'other').replace('10.0.0.1', {
+      subnets: ['172.16.9.0/24'],
       description: 'elsewhere',
     });
 
@@ -80,7 +116,7 @@ describe('trusted-source store', () => {
   });
 
   it('reports every registration across firewalls, with who registered it', () => {
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'vpn' });
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, { subnets: [VPN], description: 'vpn' });
 
     expect(listAllTrustedSources(db)).toEqual([
       { firewallIp: FW, subnet: VPN, description: 'vpn', registeredBy: 'wireguard' },
@@ -104,7 +140,10 @@ describe('the render input excludes registrations; the reporting view includes t
     process.env.CELILO_DB_PATH = dbPath;
     db = await setupTestDatabase(dbPath);
     db.insert(systemConfig).values({ key: 'network.internal.subnet', value: CONTROL_PLANE }).run();
-    buildTrustedSourceStore(db, 'wireguard').add(FW, { subnet: VPN, description: 'admin VPN' });
+    buildTrustedSourceStore(db, 'wireguard').replace(FW, {
+      subnets: [VPN],
+      description: 'admin VPN',
+    });
   });
   afterEach(() => {
     db.$client.close();

package/src/services/trusted-sources.ts

@@ -38,31 +38,41 @@ export function buildTrustedSourceStore(db: DbClient, registeredBy: string): Tru
         }));
     },
 
-    add(firewallIp: string, source: RegisterTrustedSourceRequest): void {
-      // Idempotent upsert on (firewall, subnet) — matches buildPortForwardStore.
+    replace(firewallIp: string, source: RegisterTrustedSourceRequest): void {
+      // The consumer's COMPLETE set for this firewall (D5b), scoped to its own
+      // rows: a subnet it trusted before and omits now loses its reach, and a
+      // subnet another module also trusts keeps it. Changing an admin VPN's
+      // client subnet used to leave the old one reaching every zone forever.
       db.delete(trustedSources)
         .where(
-          and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, source.subnet)),
+          and(
+            eq(trustedSources.firewallIp, firewallIp),
+            eq(trustedSources.registeredBy, registeredBy),
+          ),
         )
         .run();
-      db.insert(trustedSources)
-        .values({
-          firewallIp,
-          subnet: source.subnet,
-          description: source.description,
-          registeredBy,
-        })
-        .run();
-    },
 
-    remove(firewallIp: string, subnet: string): void {
-      db.delete(trustedSources)
-        .where(and(eq(trustedSources.firewallIp, firewallIp), eq(trustedSources.subnet, subnet)))
+      if (source.subnets.length === 0) return;
+
+      db.insert(trustedSources)
+        .values(
+          source.subnets.map((subnet) => ({
+            firewallIp,
+            subnet,
+            description: source.description,
+            registeredBy,
+          })),
+        )
         .run();
     },
   };
 }
 
+/** Drop every trusted source a departing module owns, across every firewall. */
+export function deleteTrustedSourcesForModule(db: DbClient, moduleId: string): void {
+  db.delete(trustedSources).where(eq(trustedSources.registeredBy, moduleId)).run();
+}
+
 /** Where a trusted subnet came from — reach into every tier must be attributable. */
 export type TrustedSubnetOrigin = 'derived-control-plane' | 'registered' | 'operator-override';