@celilo/cli 1.13.0 → 2.0.0

package/src/hooks/hook-jail-toolchain-reach.test.ts

@@ -0,0 +1,224 @@
+/**
+ * What TOOLING the jail leaves a hook (task 4.13).
+ *
+ * `hook-jail-unreachability.test.ts` asserts D9's filesystem claims and they
+ * hold. This suite asks the question D9's table never answers, and the answer
+ * turns out to be the reason task 4.13 exists: **the fleet's real hooks shell
+ * out, and the jail as derived today has no shell.**
+ *
+ * `execSync` spawns `/bin/sh -c`. `remote.ts` — the single seam every remote
+ * primitive routes through — builds an `ssh <user>@<host> <cmd>` string and
+ * hands it to exactly that. The derivation binds `/usr/lib`, `/lib`, `/lib64`
+ * and `/etc/ssl`, and nothing else outside the module's own tree. No `/bin`,
+ * no `/usr/bin`, no `/etc/resolv.conf`.
+ *
+ * That is measured here rather than argued, because reading the derivation is
+ * what produced the belief that stage 2 was complete. The mount set is correct
+ * about every path it names. It is silent about the ones a hook needs to run
+ * another program at all, and silence and correctness look identical from the
+ * outside.
+ *
+ * ⚠️ **These tests assert the CURRENT reach, including the failures.** They are
+ * not a wish list. When stage 2 gains a shell — or stage 3 brokers the remote
+ * calls and hooks stop needing one — the expectations here change with it, and
+ * the diff that changes them is where somebody states which of those happened.
+ * A suite that asserted the desired end state would be red for the whole of
+ * stage 2 and would teach nobody anything.
+ *
+ * **Needs a real jail and skips without one, loudly**, for the reason its
+ * neighbour gives: a check that cannot reach its subject returns a confident
+ * answer about nothing.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { executeHookScript } from './executor';
+import { detectJailBackend } from './jail';
+import { createCapturingLogger } from './logger';
+import type { HookContext } from './types';
+
+const PROBE_HOOK = resolve(__dirname, 'test-fixtures/jail-toolchain-hook.ts');
+
+interface Probe {
+  succeeded: boolean;
+  detail: string;
+}
+
+interface Reach {
+  shell: Probe;
+  exec_without_shell: Probe;
+  ssh: Probe;
+  ansible: Probe;
+  resolv_conf: Probe;
+  dns_lookup: Probe;
+  nsswitch: Probe;
+  hosts_file: Probe;
+  playwright_cache: Probe;
+  celilo_browser_root: Probe;
+  data_dir_sibling: Probe;
+  dynamic_loader: Probe;
+  browser_binary_present: Probe;
+  browser_sandboxed: Probe;
+  browser_no_sandbox: Probe;
+  bwrap_present: Probe;
+}
+
+/**
+ * A real browser to launch inside the jail, or nothing.
+ *
+ * Task 4.10's question cannot be answered without one, and most hosts have
+ * none. `CELILO_PROBE_BROWSER` names it for the run that does — the Docker
+ * image this suite's finding was measured in. Absent, the two browser probes
+ * report "no browser supplied" and the run says so out loud rather than
+ * reporting an ABSENT that means "not tested".
+ */
+const PROBE_BROWSER = process.env.CELILO_PROBE_BROWSER ?? '';
+
+/**
+ * The browser's directory, refused if handing it over would defeat this
+ * suite's own `bwrap` guard.
+ *
+ * Binding the browser's directory as a path input is how a browser reaches the
+ * jail here. Point `CELILO_PROBE_BROWSER` at `/usr/bin/chromium` and that
+ * directory is `/usr/bin`, which carries `bwrap` in with it — the guard below
+ * then fails for a reason that is the harness's fault, not the derivation's.
+ * Measured: it happened on the first run of this file.
+ *
+ * Debian's `/usr/bin/chromium` is a `#!/bin/sh` wrapper anyway and cannot exec
+ * in a jail with no shell. The real ELF is under `/usr/lib`, which the
+ * derivation already binds, so the honest browser to name is that one.
+ */
+function probeBrowserDir(): string {
+  const dir = dirname(PROBE_BROWSER);
+  if (existsSync(join(dir, 'bwrap'))) {
+    throw new Error(
+      `CELILO_PROBE_BROWSER=${PROBE_BROWSER} would bind ${dir}, which holds bwrap and would defeat the guard this suite exists to keep. Name the browser's real ELF (Debian: /usr/lib/chromium/chromium), not the /usr/bin wrapper.`,
+    );
+  }
+  return dir;
+}
+
+const availability = detectJailBackend();
+const jailed = availability.backend !== 'none';
+
+/** Run the probe hook against a module tree laid out the way celilo lays one out. */
+async function measureReach(): Promise<{ reach: Reach; cleanup: () => void }> {
+  const scratch = mkdtempSync(join(tmpdir(), 'celilo-jail-reach-'));
+  const modulePath = join(scratch, 'modules', 'jail-reach');
+  const stateDir = join(modulePath, 'state');
+  const screenshotDir = join(modulePath, 'screenshots', 'run');
+  mkdirSync(join(modulePath, 'scripts'), { recursive: true });
+  mkdirSync(stateDir, { recursive: true });
+  mkdirSync(screenshotDir, { recursive: true });
+
+  const { logger } = createCapturingLogger();
+  const context: HookContext = {
+    config: PROBE_BROWSER ? { browser_executable: PROBE_BROWSER } : {},
+    secrets: {},
+    systems: [],
+    logger,
+    debug: false,
+    screenshotDir,
+    stateDir,
+    capabilities: {},
+  };
+
+  const reach = (await executeHookScript(PROBE_HOOK, context, {
+    timeoutMs: 60_000,
+    idleTimeoutMs: 60_000,
+    jail: {
+      modulePath,
+      // The browser reaches the jail as a DECLARED PATH INPUT, which is the
+      // mechanism 4.10's fix would use. Binding it by editing the derivation
+      // and then asking the derivation whether it is bound would prove
+      // nothing.
+      pathInputs: PROBE_BROWSER
+        ? [{ name: 'browser_executable', value: probeBrowserDir(), access: 'read' as const }]
+        : [],
+    },
+  })) as unknown as Reach;
+
+  return { reach, cleanup: () => rmSync(scratch, { recursive: true, force: true }) };
+}
+
+describe.skipIf(!jailed)(`what a jailed hook can run (backend: ${availability.backend})`, () => {
+  // 30s, not bun's default 5s: the DNS probe deliberately waits for an answer
+  // that never comes, and a runner timeout would report as a suite failure
+  // rather than as the measurement it is.
+  test('measures the reach', async () => {
+    const { reach, cleanup } = await measureReach();
+    try {
+      // Printed unconditionally, and to stderr because bun swallows a passing
+      // test's stdout. This suite's value is the table, and a run that only
+      // says "1 pass" has thrown the finding away.
+      for (const [name, probe] of Object.entries(reach)) {
+        console.error(`  ${probe.succeeded ? 'REACHED' : 'ABSENT '} ${name}: ${probe.detail}`);
+      }
+
+      // ── The finding ────────────────────────────────────────────────────
+      // No shell, so `execSync` cannot run and neither can any hook that uses
+      // it. 22 module script files import `node:child_process`.
+      expect(reach.shell.succeeded).toBe(false);
+      expect(reach.exec_without_shell.succeeded).toBe(false);
+
+      // `~/.ssh` is bound read-only in stage 2 specifically so `remote.ts`
+      // keeps working. There is no `ssh` to hand that key to.
+      expect(reach.ssh.succeeded).toBe(false);
+      expect(reach.ansible.succeeded).toBe(false);
+
+      // Nothing binds the resolver's configuration.
+      expect(reach.resolv_conf.succeeded).toBe(false);
+
+      // ── Task 4.10 ──────────────────────────────────────────────────────
+      // `~/.cache/ms-playwright` is the path task 4.10 names and it is bound
+      // by nothing, deliberately: `managed-browser-runtime` moved the browser
+      // into a celilo-owned tree, so binding the cache would bind a directory
+      // nothing launches from.
+      expect(reach.playwright_cache.succeeded).toBe(false);
+
+      // Binding BROWSER_ROOT must not expose what sits beside it. This one IS
+      // asserted unconditionally: `master.key` is unreadable whether or not
+      // the browser directory exists on this host, so unlike the row below
+      // there is no configuration in which this passes vacuously.
+      expect(reach.data_dir_sibling.succeeded).toBe(false);
+
+      // `BROWSER_ROOT` is NOT asserted here, and the reason is worth stating
+      // because asserting it would be the trap this file exists to avoid.
+      // `deriveMountSet` now emits the row, but `planJailedSpawn` drops any
+      // row whose source is missing — so on a host with no provisioned
+      // browser this probe reports ABSENT for a reason that has nothing to do
+      // with the mount set, and an assertion either way would be measuring
+      // the host rather than the derivation. The row itself is asserted
+      // hermetically in `mount-set.test.ts`, where it can be.
+
+      // The nesting question, asserted only on a run that supplied a browser.
+      // Measured 2026-08-28 in `oven/bun:latest` on aarch64 with Debian's
+      // chromium: with its own sandbox Chromium will not start inside the
+      // jail, and `--no-sandbox` renders. That is task 4.10's prediction
+      // confirmed, and it says what the fix has to include.
+      if (PROBE_BROWSER) {
+        expect(reach.browser_binary_present.succeeded).toBe(true);
+        expect(reach.browser_sandboxed.succeeded).toBe(false);
+        expect(reach.browser_no_sandbox.succeeded).toBe(true);
+      }
+
+      // ── The guard ──────────────────────────────────────────────────────
+      // Opposite direction, and it must never flip. D9 predicts the exact
+      // edit that would flip it: someone reads the failures above, binds
+      // `/usr/bin` to fix them, and brings `bwrap` in with it. `isForbidden`
+      // compares whole paths, so a bind of the DIRECTORY passes that filter.
+      expect(reach.bwrap_present.succeeded).toBe(false);
+    } finally {
+      cleanup();
+    }
+  }, 30_000);
+});
+
+describe.skipIf(jailed)('no jail on this host', () => {
+  test('says so rather than passing quietly', () => {
+    console.log(`hook jail unavailable, so 4.13's reach was NOT measured: ${availability.reason}`);
+    expect(availability.backend).toBe('none');
+  });
+});

package/src/hooks/hook-jail-unreachability.test.ts

@@ -27,8 +27,11 @@
 
 import { describe, expect, test } from 'bun:test';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
+
+/** Uniquely named so it never collides with a real key on a jailed dev box. */
+const PLANTED_KEY_NAME = 'id_celilo_jail_probe';
 import { executeHookScript } from './executor';
 import { detectJailBackend } from './jail';
 import { createCapturingLogger } from './logger';
@@ -50,6 +53,7 @@ interface Rig {
     sibling_write: Probe;
     state_write: Probe;
     staged_write: Probe;
+    ssh_key: Probe;
   };
   stagedInput: string;
   siblingFile: string;
@@ -85,6 +89,20 @@ async function runProbe(): Promise<Rig> {
   // produces. This is the path the tmpfs would erase.
   const stagedInput = mkdtempSync(join(tmpdir(), 'celilo-jail-staged-'));
 
+  // A throwaway SSH key at the exact path the pre-stage-3 jail bound —
+  // `homedir()/.ssh` — so the flip (task 5.5) is real: the red baseline
+  // binds this directory and the probe reads the key, this branch binds no
+  // `.ssh` at all and the read gives ENOENT. Guarded to jailed hosts only
+  // (this whole suite is `skipIf(!jailed)`), which on a Mac is never — so
+  // the operator's real key is never touched on a dev box; on a jailed CI
+  // box homedir is an ephemeral container root. Uniquely named and removed
+  // in cleanup regardless.
+  const sshDir = join(homedir(), '.ssh');
+  const plantedKey = join(sshDir, PLANTED_KEY_NAME);
+  const createdSshDir = !existsSync(sshDir);
+  mkdirSync(sshDir, { recursive: true });
+  writeFileSync(plantedKey, 'not-a-real-key\n');
+
   const { logger } = createCapturingLogger();
   const context: HookContext = {
     config: {
@@ -117,6 +135,8 @@ async function runProbe(): Promise<Rig> {
     cleanup: () => {
       rmSync(scratch, { recursive: true, force: true });
       rmSync(stagedInput, { recursive: true, force: true });
+      rmSync(plantedKey, { force: true });
+      if (createdSshDir) rmSync(sshDir, { recursive: true, force: true });
     },
   };
 }
@@ -125,7 +145,7 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
   test('a hook cannot reach celilo’s master key, or a sibling module', async () => {
     const rig = await runProbe();
     try {
-      const { planted_secret, sibling_write, state_write, staged_write } = rig.outputs;
+      const { planted_secret, sibling_write, state_write, staged_write, ssh_key } = rig.outputs;
       console.log(['', 'jail probe:', JSON.stringify(rig.outputs, null, 2)].join('\n'));
 
       // Unreachability, not an errno. Under bubblewrap the message is ENOENT
@@ -136,6 +156,12 @@ describe.skipIf(!jailed)(`the jail is real (backend: ${availability.backend})`,
       // And the parent's own view: the write did not land by another route.
       expect(existsSync(rig.siblingFile)).toBe(false);
 
+      // Stage 3 (design D12, task 5.5): the SSH credential is not bound, so
+      // a jailed hook cannot authenticate anywhere by hand. This is the
+      // recurrence-gate row that FLIPPED when the `~/.ssh` mount was removed
+      // — it read `succeeded: true` for the whole of stage 2.
+      expect(ssh_key.succeeded).toBe(false);
+
       // The carve-out. `state/` is inside the read-only module tree and is
       // bound read-write on top of it; if the ordering were wrong this is the
       // assertion that would catch it.

package/src/hooks/hook-protocol.ts

@@ -31,6 +31,28 @@ export const HOOK_PROTOCOL_VERSION = 1;
 export const HOOK_SOCKET_ENV = 'CELILO_HOOK_SOCKET';
 /** Environment variable carrying the parent's protocol version to the child. */
 export const HOOK_PROTOCOL_VERSION_ENV = 'CELILO_HOOK_PROTOCOL_VERSION';
+/**
+ * Environment variable carrying the remote-ops broker's socket path (stage 3,
+ * design D12). The ASKING half lives in `@celilo/capabilities`' remote
+ * primitives, which a module bundles — so that side names this variable as a
+ * string literal of its own (`packages/capabilities/src/remote.ts`), and the
+ * two must agree the way the socket framing must.
+ */
+export const HOOK_REMOTE_SOCKET_ENV = 'CELILO_HOOK_REMOTE_SOCKET';
+/**
+ * Environment variable carrying the derived mount set to the child, as JSON
+ * (task 4.7, the unjailed advisory lint).
+ *
+ * Set ONLY when the run is unjailed AND a mount set exists — its presence is
+ * the shim's signal to install the lint, so a jailed run carries nothing. The
+ * environment is the right channel rather than a protocol frame because this
+ * is spawn-time configuration of the shim, exactly like the two socket paths
+ * above, and because the value is finalised in the same planning step that
+ * picks the spawn command. The child validates it with `MountSetWireSchema`
+ * before use; it is written by celilo and read by celilo, but it crosses a
+ * process boundary and gets the same treatment as any other payload.
+ */
+export const HOOK_MOUNT_SET_ENV = 'CELILO_HOOK_MOUNT_SET';
 
 /**
  * An error crossing the boundary.
@@ -111,6 +133,28 @@ export const ContextFrameSchema = z.object({
   context: z.record(z.unknown()),
 });
 
+/**
+ * One row of the mount set, on the wire.
+ *
+ * Structural twin of `mount-set.ts`'s `MountEntry`. Duplicated as a schema
+ * rather than imported because this file is the wire contract and the wire
+ * must not grow a compile-time dependency on the derivation's internals —
+ * `hook-protocol.ts`'s docblock records who may import whom.
+ */
+export const MountEntrySchema = z.object({
+  path: z.string(),
+  mode: z.enum(['ro', 'rw', 'tmpfs']),
+  reason: z.string(),
+});
+
+/** The derived mount set, on the wire. Structural twin of `MountSet`. */
+export const MountSetWireSchema = z.object({
+  entries: z.array(MountEntrySchema),
+  chdir: z.string(),
+});
+
+export type MountSetWire = z.infer<typeof MountSetWireSchema>;
+
 /**
  * The capability shape descriptor (design D2).
  *

package/src/hooks/hook-runner-entry.ts

@@ -0,0 +1,23 @@
+/**
+ * The runner shim's entry point — the first file the hook process executes.
+ *
+ * **It exists to fix the evaluation order of one import.** The advisory lint
+ * (`unjailed-lint.ts`) must have its `node:fs` wrappers in place before any
+ * other module in this process ESM-loads `node:fs`, because Bun resolves a
+ * builtin's named ESM exports once — the first import freezes them. The
+ * runner shim itself imports `@celilo/capabilities`, whose graph reaches
+ * `node:fs`, so by the time the shim's own body could install anything, the
+ * facade is already frozen and the lint is silently disarmed (measured while
+ * landing task 4.7; `unjailed-lint.test.ts` goes red without this file).
+ *
+ * So: install first (the module also self-installs at evaluation; the guard
+ * makes whichever lands first correct), and only then hand off to the real
+ * runner. Nothing else belongs in this file, and nothing here may import a
+ * module whose graph reaches `node:fs` — that is the whole point of it.
+ */
+
+import { installUnjailedLintIfUnjailed } from './unjailed-lint';
+
+installUnjailedLintIfUnjailed();
+
+await import('./hook-runner');

package/src/hooks/hook-runner.ts

@@ -27,6 +27,12 @@ import {
   versionMismatch,
 } from './hook-protocol';
 import type { HookContext, HookLogger } from './types';
+import { forwardLintWarnings } from './unjailed-lint';
+
+// The advisory lint was installed before this module was even loaded — the
+// executor spawns `hook-runner-entry.ts`, whose first statement forces
+// `unjailed-lint`'s evaluation (see that module's docblock for why the order
+// is load-bearing there and irrelevant here).
 
 const socketPath = process.env[HOOK_SOCKET_ENV];
 if (!socketPath) {
@@ -123,6 +129,10 @@ async function runHook(): Promise<void> {
       if (!(field in contextData)) throw new Error(`Hook context is missing '${field}'.`);
     }
 
+    // Before the import, not after — the lint's warnings flow through the
+    // hook's logger from here on (anything earlier was buffered).
+    forwardLintWarnings(logger.warn);
+
     const context = {
       ...contextData,
       logger,

package/src/hooks/hook-trespass.test.ts

@@ -178,12 +178,13 @@ describe('the child environment is an allow-list', () => {
   // complement: the six things that MUST get through, because a hook with no
   // `PATH` cannot spawn anything and one with no `HOME` breaks more than it
   // protects.
-  test('forwards the allow-list and the channel, and nothing else', () => {
+  test('forwards the allow-list and the channels, and nothing else', () => {
     process.env.CELILO_TEST_SECRET = 'must-not-cross';
     try {
-      const env = hookChildEnv('/tmp/celilo-hook-x/s');
+      const env = hookChildEnv('/tmp/celilo-hook-x/s', '/tmp/celilo-hook-x/r', undefined);
 
       expect(env.CELILO_HOOK_SOCKET).toBe('/tmp/celilo-hook-x/s');
+      expect(env.CELILO_HOOK_REMOTE_SOCKET).toBe('/tmp/celilo-hook-x/r');
       expect(env.CELILO_HOOK_PROTOCOL_VERSION).toBe('1');
       expect(env.PATH).toBe(process.env.PATH as string);
       expect(env.HOME).toBe(process.env.HOME as string);
@@ -197,9 +198,14 @@ describe('the child environment is an allow-list', () => {
         'TMPDIR',
         'CELILO_DEBUG',
         'CELILO_HOOK_SOCKET',
+        'CELILO_HOOK_REMOTE_SOCKET',
         'CELILO_HOOK_PROTOCOL_VERSION',
+        'CELILO_HOOK_MOUNT_SET',
       ]);
       expect(Object.keys(env).filter((name) => !allowed.has(name))).toEqual([]);
+      // The unjailed lint's variable is present only when there is something
+      // to lint (task 4.7). A jailed run carries nothing.
+      expect(env.CELILO_HOOK_MOUNT_SET).toBeUndefined();
     } finally {
       delete process.env.CELILO_TEST_SECRET;
     }
@@ -211,7 +217,7 @@ describe('the child environment is an allow-list', () => {
     try {
       // Absent, not the string "undefined" — which is what a naive copy
       // produces and what a shell then happily uses as a timezone.
-      expect('TZ' in hookChildEnv('/tmp/s')).toBe(false);
+      expect('TZ' in hookChildEnv('/tmp/s', '/tmp/r', undefined)).toBe(false);
     } finally {
       if (saved !== undefined) process.env.TZ = saved;
     }

package/src/hooks/jail-browser-launch-flags.test.ts

@@ -0,0 +1,34 @@
+/**
+ * The jailed browser launch path starts Chromium with `--no-sandbox` (task
+ * 4.10 interim, celilo#1215).
+ *
+ * The behavioural proof lives in `hook-jail-toolchain-reach.test.ts`: with its
+ * own sandbox on, Chromium does not start inside the bubblewrap jail; with
+ * `--no-sandbox` it renders. But that run needs `CELILO_PROBE_BROWSER`, so on
+ * an ordinary host it reports "no browser supplied" and nothing would fail if
+ * the flag were dropped from the launcher. This suite is the pin that always
+ * runs: it asserts the launch args the probe hook actually uses, and it fails
+ * the moment `--no-sandbox` leaves the launch path.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { JAILED_LAUNCH_ARGS, SANDBOXED_LAUNCH_ARGS } from './test-fixtures/jail-toolchain-hook';
+
+describe('jailed browser launch flags (4.10 interim, celilo#1215)', () => {
+  test('the jailed launch path carries --no-sandbox', () => {
+    expect(JAILED_LAUNCH_ARGS).toContain('--no-sandbox');
+  });
+
+  test('the experiment arm keeps Chromium sandboxed, so the comparison stays controlled', () => {
+    expect(SANDBOXED_LAUNCH_ARGS).not.toContain('--no-sandbox');
+  });
+
+  test('the two arms differ by the sandbox flag alone', () => {
+    const onlyInJailed = JAILED_LAUNCH_ARGS.filter((arg) => !SANDBOXED_LAUNCH_ARGS.includes(arg));
+    const onlyInSandboxed = SANDBOXED_LAUNCH_ARGS.filter(
+      (arg) => !JAILED_LAUNCH_ARGS.includes(arg),
+    );
+    expect(onlyInJailed).toEqual(['--no-sandbox']);
+    expect(onlyInSandboxed).toEqual([]);
+  });
+});

package/src/hooks/jail.test.ts

@@ -18,6 +18,7 @@ import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
+  JAIL_OFF_REASON,
   type JailAvailability,
   type JailPlan,
   jailModeStorePath,
@@ -227,6 +228,37 @@ describe('the three policies', () => {
   });
 });
 
+describe('auto defers on sandbox-exec until D14 exists (ce-29z)', () => {
+  // The backend hand-built here is one no probe yields yet — task 4.8 owns
+  // the platform probe that reports it. The policy, though, is decided NOW:
+  // sandbox-exec denies (EPERM) a hook write to an undeclared host path where
+  // bubblewrap masks it into its private tmpfs, so a macOS auto jail reddens
+  // the full suite for fixtures main's Linux CI passes. Measured, ce-29z.
+  const SANDBOX_EXEC: JailAvailability = { backend: 'sandbox-exec' };
+
+  test("'auto' runs the hook unjailed and says why", () => {
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'auto', allPresent);
+    expect(p.mode).toBe('unjailed');
+    expect(p.cmd).toEqual(CMD);
+    expect(p.backend).toBe('sandbox-exec');
+    expect(p.reason).toMatch(/D14/);
+    expect(p.reason).toMatch(/CELILO_HOOK_JAIL=required/);
+  });
+
+  test("'required' is the operator's explicit act and is NOT deferred", () => {
+    // Mode only, not argv shape: the sandbox-exec spawn arm is task 4.8's.
+    // This assertion survives that landing; an argv assertion would not.
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'required', allPresent);
+    expect(p.mode).toBe('jailed');
+  });
+
+  test("'off' still declines a jail that IS available", () => {
+    const p = planJailedSpawn(CMD, deriveMountSet(REQUEST), SANDBOX_EXEC, 'off', allPresent);
+    expect(p.mode).toBe('unjailed');
+    expect(p.reason).toBe(JAIL_OFF_REASON);
+  });
+});
+
 describe('jailPolicy reads the operator’s switch', () => {
   const withEnv = <T>(value: string | undefined, fn: () => T): T => {
     const saved = process.env.CELILO_HOOK_JAIL;
@@ -367,4 +399,64 @@ describe('the mode is recorded state, not a log line (design D8)', () => {
       if (saved !== undefined) process.env.CELILO_HOOK_JAIL_MODE_PATH = saved;
     }
   });
+
+  // The write overwrites the previous record, and the self-monitor (task 4.4)
+  // reads the file on a sweep long after `recordJailMode`'s return value is
+  // gone. `lastJailed` is what keeps the transition readable.
+  test('an unjailed record remembers the jailed record it replaced (task 4.4)', () => {
+    withStore(() => {
+      recordJailMode(jailed);
+      const jailedAt = readJailMode()?.recordedAt;
+      recordJailMode(unjailed);
+      const record = readJailMode();
+      expect(record?.lastJailed?.backend).toBe('bubblewrap');
+      expect(record?.lastJailed?.recordedAt).toBe(jailedAt as string);
+    });
+  });
+
+  test('re-jailing clears the memory, so a later regression dates from the new jailed record', () => {
+    withStore(() => {
+      recordJailMode(jailed);
+      recordJailMode(unjailed);
+      recordJailMode(jailed);
+      expect(readJailMode()?.lastJailed).toBeUndefined();
+    });
+  });
+
+  test('an unjailed-to-unjailed rewrite carries the memory along', () => {
+    withStore(() => {
+      // CELILO_HOOK_JAIL=off on a host whose backend still works: mode
+      // unjailed, backend bubblewrap. The regression memory must survive the
+      // operator then losing the backend too.
+      const off: JailPlan = {
+        cmd: CMD,
+        mode: 'unjailed',
+        backend: 'bubblewrap',
+        reason: 'CELILO_HOOK_JAIL=off',
+        skipped: [],
+      };
+      recordJailMode(jailed);
+      const jailedAt = readJailMode()?.recordedAt;
+      recordJailMode(off);
+      recordJailMode(unjailed);
+      expect(readJailMode()?.lastJailed?.recordedAt).toBe(jailedAt as string);
+    });
+  });
+
+  test("another host's jailed record is a move, not a transition", () => {
+    withStore((path) => {
+      mkdirSync(join(path, '..'), { recursive: true });
+      writeFileSync(
+        path,
+        JSON.stringify({
+          mode: 'jailed',
+          backend: 'bubblewrap',
+          host: 'some-other-box',
+          recordedAt: '2026-01-01T00:00:00.000Z',
+        }),
+      );
+      recordJailMode(unjailed);
+      expect(readJailMode()?.lastJailed).toBeUndefined();
+    });
+  });
 });