@celilo/cli 1.5.0 → 1.7.0

package/src/services/deployed-systems.ts

@@ -236,6 +236,35 @@ function asZone(value: string | null | undefined): NetworkZone | null {
     : null;
 }
 
+/** True for an IPv4 loopback address, including CIDR-form input. */
+function isLoopbackIpv4(value: string): boolean {
+  return stripCidr(value).startsWith('127.');
+}
+
+/**
+ * The machine pool uses 127.0.0.1 as a transport sentinel for the machine
+ * running celilo itself: it selects Ansible's local connection rather than
+ * SSH. That value is not the machine's network identity and must never leak
+ * into module_systems (and, downstream, internal DNS).
+ *
+ * For an ordinary machine, its primary address remains canonical. For the
+ * local sentinel, use the catalogued non-loopback interface in the system's
+ * resolved zone. Deliberately do not fall back to an arbitrary interface: a
+ * control plane can also have an upstream/Wi-Fi address, and publishing that
+ * would be a quieter version of the same identity bug.
+ */
+export function resolveMachineIdentityAddress(
+  machine: typeof machines.$inferSelect | undefined,
+  zone: NetworkZone,
+): string | undefined {
+  if (!machine) return undefined;
+  if (!isLoopbackIpv4(machine.ipAddress)) return machine.ipAddress;
+
+  return machine.interfaces.find(
+    (iface) => asZone(iface.zone) === zone && !isLoopbackIpv4(iface.ipAddress),
+  )?.ipAddress;
+}
+
 /**
  * Resolve a module's deployed system(s) from the deploy state and persist them
  * to `module_systems`. Called during deploy after infrastructure variables are
@@ -265,14 +294,9 @@ export async function recordDeployedSystemForModule(
   // No hostname → not yet addressable. A modeled state, not an error.
   if (!hostname) return [];
 
-  // IP: the module's resolved target_ip, else ip.primary, else the assigned
-  // machine's own IP (machine-pool deploys where neither was written).
-  let ip = cfg('target_ip') ?? cfg('ip.primary');
   const machine = infrastructure?.machineId
     ? db.select().from(machines).where(eq(machines.id, infrastructure.machineId)).get()
     : undefined;
-  if (!ip) ip = machine?.ipAddress;
-  if (!ip) return [];
 
   // Single-system transition: take the first declared system's name + zone.
   const decl = declared[0];
@@ -289,6 +313,13 @@ export async function recordDeployedSystemForModule(
     );
   }
 
+  // IP: the module's resolved target_ip, else ip.primary, else the assigned
+  // machine's network identity. A local machine's 127.0.0.1 primary address is
+  // an execution-transport sentinel, so resolve its identity from the
+  // catalogued interface in the system's actual zone instead.
+  const ip = cfg('target_ip') ?? cfg('ip.primary') ?? resolveMachineIdentityAddress(machine, zone);
+  if (!ip) return [];
+
   const infraType = infrastructure?.type ?? 'machine';
   const vmidStr = cfg('vmid');
   const vmid = vmidStr ? Number.parseInt(vmidStr, 10) : null;
@@ -352,15 +383,9 @@ export function backfillModuleSystems(db: DbClient): string[] {
     const hostname = cfg('hostname');
     if (!hostname) continue;
 
-    // IP: resolved target_ip, else ip.primary, else the assigned machine's own
-    // IP (machine-pool deploy where neither was written). Mirrors
-    // recordDeployedSystemForModule. CIDR is stripped by upsertDeployedSystem.
-    let ip = cfg('target_ip') ?? cfg('ip.primary');
     const machine = infra.machineId
       ? db.select().from(machines).where(eq(machines.id, infra.machineId)).get()
       : undefined;
-    if (!ip) ip = machine?.ipAddress;
-    if (!ip) continue;
 
     const decl = declared[0];
     // Same precedence as recordDeployedSystemForModule: the machine a deploy
@@ -373,6 +398,13 @@ export function backfillModuleSystems(db: DbClient): string[] {
     // backfill (a re-deploy will record it properly).
     if (!zone) continue;
 
+    // Mirrors recordDeployedSystemForModule. For celilo's local machine,
+    // 127.0.0.1 is only a local-transport sentinel; the zone-matching
+    // catalogued interface is the deployed system's address.
+    const ip =
+      cfg('target_ip') ?? cfg('ip.primary') ?? resolveMachineIdentityAddress(machine, zone);
+    if (!ip) continue;
+
     const vmidStr = cfg('vmid');
     const vmid = vmidStr ? Number.parseInt(vmidStr, 10) : null;
 

package/src/services/dns-provider-backfill.ts

@@ -12,6 +12,36 @@
  * All DNS mechanics (which zones, register vs delete) live in the module's
  * hook; this file only decides WHICH hosts and invokes the hook. That is the
  * D5 division of labour: celilo owns host inventory, the module owns DNS.
+ *
+ * WHY THIS SURVIVED THE GENERIC PROVIDER-ARRIVAL BACKFILL
+ * (openspec/changes/capability-owned-tables task 1.7). `provider-arrival.ts`
+ * replaced `public-web-republish.ts` and covers `firewall` for the first time.
+ * It does NOT cover either function here, and deleting this file over it would
+ * silently take internal DNS with it. Two independent reasons, both checked
+ * against the manifests rather than assumed:
+ *
+ *   1. `backfillProviderDns` replays celilo's HOST INVENTORY — one record per
+ *      deployed system, across every module. Those systems are hosts, not
+ *      consumers. There is no `requires`/`optional` edge to fan out along
+ *      because none of them asked `dns_internal` for anything. It is not a
+ *      capability registration set, so a mechanism defined over consumer
+ *      declarations cannot reach it.
+ *
+ *   2. `backfillWebRouteDns` covers the FQDNs modules publish through
+ *      `public_web`. Those modules declare `public_web` — `authentik`,
+ *      `forgejo`, `celilo-registry`, `celilo-apt-repo`, `celilo-website`,
+ *      `npm-cache-node` and the two hello fixtures. NOT ONE declares
+ *      `dns_internal`. The only module that does is `caddy-internal`, and it
+ *      declares it `optional`. So a `dns_internal` provider arriving has no
+ *      edge to the modules whose records it needs to learn.
+ *
+ * Point 2 is still second-implementation debt, and it is already ledgered:
+ * `module-business-baseline.ts` carries this file under S3 (#945). Retiring it
+ * needs a `public_web` fan-out triggered by a `dns_internal` arrival — a
+ * CROSS-capability edge the pull-shaped design does not define — because
+ * `register_route` (packages/capabilities/src/public-web.ts) already writes
+ * exactly the record `backfillWebRouteDns` reconstructs by hand, with the same
+ * value and the same `zoneRoutableValue`.
  */
 
 import type { DnsInternalCapability, HookLogger } from '@celilo/capabilities';

package/src/services/fleet-checks.test.ts

@@ -650,6 +650,32 @@ describe('findBrokenCapabilityDerivations (shared predicate)', () => {
     expect(problems).toHaveLength(0);
   });
 
+  it('accepts a broken optional derivation when the manifest declares a fallback', () => {
+    const withFallback = baseManifest({
+      id: 'secondary-dns',
+      variables: {
+        owns: [
+          {
+            name: 'managed_domains',
+            type: 'array',
+            required: false,
+            default: [],
+            source: 'capability',
+            derive_from: '$capability:dns_internal.dns.managed_domains',
+          },
+        ],
+        imports: [],
+      },
+    });
+
+    expect(findBrokenCapabilityDerivations('secondary-dns', withFallback, {})).toEqual([]);
+    expect(
+      findBrokenCapabilityDerivations('secondary-dns', withFallback, {
+        dns_internal: { dns: { managed_domains: '$self:managed_domains' } },
+      }),
+    ).toEqual([]);
+  });
+
   it('walks dotted paths', () => {
     const m = baseManifest({
       id: 'consumer',

package/src/services/fleet-checks.ts

@@ -502,6 +502,8 @@ interface CapabilityRef {
   variable: string;
   capability: string;
   path: string;
+  /** A manifest default makes an absent/broken optional derivation safe. */
+  hasFallback: boolean;
 }
 
 export type CapabilityDerivationReason = 'no-provider' | 'empty-value' | 'unresolved-ref';
@@ -531,7 +533,12 @@ function parseCapabilityRefs(manifest: ModuleManifest): CapabilityRef[] {
     const re = /\$\{?capability:([\w-]+)\.([\w.]+)/g;
     let m: RegExpExecArray | null = re.exec(v.derive_from);
     while (m !== null) {
-      refs.push({ variable: v.name, capability: m[1], path: m[2] });
+      refs.push({
+        variable: v.name,
+        capability: m[1],
+        path: m[2],
+        hasFallback: Object.prototype.hasOwnProperty.call(v, 'default'),
+      });
       m = re.exec(v.derive_from);
     }
   }
@@ -578,15 +585,18 @@ export function findBrokenCapabilityDerivations(
     };
     const data = capabilities[ref.capability];
     if (!data) {
+      if (ref.hasFallback) continue;
       problems.push({ ...base, reason: 'no-provider' });
       continue;
     }
     const value = getNested(data, ref.path);
     if (value === undefined || value === null || value === '') {
+      if (ref.hasFallback) continue;
       problems.push({ ...base, reason: 'empty-value' });
       continue;
     }
     if (typeof value === 'string' && UNRESOLVED_REF.test(value)) {
+      if (ref.hasFallback) continue;
       problems.push({ ...base, reason: 'unresolved-ref', value });
     }
   }

package/src/services/module-deploy.ts

@@ -40,8 +40,12 @@ import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { findMachineForModule } from './machine-pool';
 import { ensureRequiredNetworks } from './network-ensure';
+import {
+  type ProviderBackfillResult,
+  loadProviderBackfillPlan,
+  runProviderBackfill,
+} from './provider-arrival';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
-import { republishStaticWebConsumers } from './public-web-republish';
 import { LOCAL_MACHINE_IP, deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
@@ -224,6 +228,81 @@ async function invokeHookWithEnsureRetry(
   }
 }
 
+/**
+ * A provider just arrived — re-run the consumers that were already here.
+ *
+ * The generic mirror of `consumer-cleanup.ts`. It replaces
+ * `republishStaticWebConsumers`, which did this for `public_web` alone, and it
+ * covers `firewall` for the first time — three modules provide `firewall` and
+ * none of their consumers inherited anything on deploy (celilo#1011).
+ *
+ * Never fatal to the provider's own deploy. The provider deployed fine; what
+ * can fail is one consumer's re-registration, and the honest report is that
+ * consumer named with the command that retries it. Silence would report a clean
+ * deploy over a fleet where some consumers never re-registered.
+ */
+// ponytail: fans out on EVERY deploy of a module that provides anything, so a
+// caddy redeploy re-runs all eight `public_web` consumers' `on_install` even
+// though caddy was already their provider and they have nothing to gain. The
+// hooks are idempotent by contract and a provider deploy is already heavyweight,
+// so this is accepted rather than guessed at — every predicate for "this
+// consumer has something to gain" that does not need new state is wrong in some
+// case (a redeploy of the incumbent provider looks identical to a first
+// deploy). If it measurably hurts, the upgrade is to record which provider a
+// consumer last bound to and re-run only where that changed.
+async function backfillArrivedProvider(moduleId: string, db: DbClient): Promise<void> {
+  const plan = loadProviderBackfillPlan(moduleId, db);
+  if (plan.length === 0) return;
+
+  const attempts = plan.filter((target) => !target.skip);
+  const gauge = new FuelGauge(`Re-registering ${attempts.length} consumer(s) with ${moduleId}`, {
+    skipAnimation: !process.stdout.isTTY,
+  });
+  gauge.start();
+  let result: ProviderBackfillResult;
+  try {
+    const logger = createGaugeLogger(gauge, moduleId, 'provider_arrival');
+    result = await runProviderBackfill(moduleId, plan, db, logger);
+    gauge.stop(result.failures.length === 0);
+  } catch (error) {
+    gauge.stop(false);
+    const msg = error instanceof Error ? error.message : String(error);
+    log.warn(`Consumer re-registration against '${moduleId}' could not run: ${msg}`);
+    return;
+  }
+
+  if (result.rerun.length > 0) {
+    log.success(
+      `Re-registered ${result.rerun.length} consumer(s) with '${moduleId}': ${result.rerun.join(', ')}`,
+    );
+  }
+  // Re-surfaced outside the gauge: the gauge's own preview scrolls away, and a
+  // consumer that never re-registered is exactly what an operator must still be
+  // able to read once the deploy has finished.
+  //
+  // INFO, not warn, and the level is load-bearing. `unpause --cascade`
+  // redeploys in topological order and clears `pausedAt` only AFTER each
+  // redeploy succeeds (`module-pause.ts#executeUnpause`), so the provider's own
+  // redeploy runs while every consumer in the cascade is still PAUSED. Warning
+  // there would put one alarm per consumer immediately before the cascade
+  // redeploys each of them successfully — an alarm about the normal path.
+  //
+  // Nothing is at risk either way: a paused module cannot return to service
+  // without a redeploy, and that redeploy re-resolves its capabilities. That is
+  // the same guarantee `remove-guard.ts` relies on to treat a paused module as
+  // not a dependent. So this is worth saying and not worth warning about.
+  for (const paused of result.skipped.filter((s) => s.reason === 'paused')) {
+    log.info(
+      `'${paused.consumerId}' is paused, so it was not re-registered with '${moduleId}'. It rebinds when it is unpaused and redeployed.`,
+    );
+  }
+  for (const failure of result.failures) {
+    log.warn(
+      `'${failure.consumerId}' failed to re-register with '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.consumerId}\` to retry.`,
+    );
+  }
+}
+
 /**
  * Orchestrate module deployment workflow
  * Orchestrator function - coordinates deployment phases
@@ -559,6 +638,27 @@ async function deployModuleImpl(
 
     log.success('Templates generated');
 
+    // Pre-flight: refuse before contacting any system if the generated project
+    // does not match the module tree it was generated from (D6).
+    //
+    // This is the check that would have turned celilo#925 from a silent success
+    // into a refusal at the point of the fault. A verbatim role asset that
+    // failed to refresh is invisible downstream: `cp` reports no error, Ansible
+    // copies the stale bytes and reports `ok`, unchanged, and the module's
+    // version advances past code that never shipped. Local, milliseconds, no
+    // SSH. It deliberately does NOT verify after the deploy — Ansible's
+    // `changed` is truthful about what Ansible did, and the lie is upstream of
+    // Ansible.
+    const { refuseIfGeneratedIsStale } = await import('../module/packaging/generated-plane');
+    const staleGenerated = await refuseIfGeneratedIsStale(
+      moduleId,
+      module.sourcePath,
+      generatedPath,
+    );
+    if (staleGenerated) {
+      return { success: false, error: staleGenerated, phases };
+    }
+
     // Run validate_config hook if defined (e.g., credential validation via Playwright)
     if (manifest.hooks?.validate_config) {
       const hookDef = manifest.hooks.validate_config;
@@ -815,26 +915,10 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
-      // A public_web provider deploy rebuilds its host and takes /srv/www with
-      // it, while consumers' route rows survive — so the fresh provider would
-      // render site blocks pointing at directories that no longer exist. Re-run
-      // each static consumer's on_install to refill them. Idempotent; failures
-      // are logged, never fatal to the provider's own deploy.
-      const republish = await republishStaticWebConsumers({
-        providerModuleId: moduleId,
-        manifest,
-        db,
-      });
-      if (republish.republished.length > 0) {
-        log.success(
-          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
-        );
-      }
-      for (const failure of republish.failures) {
-        log.warn(
-          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
-        );
-      }
+      // Whatever this module provides, the consumers that were already here
+      // never got to ask it for anything. Re-run them so they register through
+      // the path that worked the first time (design D7).
+      await backfillArrivedProvider(moduleId, db);
 
       // Mirror the infrastructure-path success message at the end of
       // a successful deploy. Without this, config-only deploys end
@@ -1493,26 +1577,10 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
-      // A public_web provider deploy rebuilds its host and takes /srv/www with
-      // it, while consumers' route rows survive — so the fresh provider would
-      // render site blocks pointing at directories that no longer exist. Re-run
-      // each static consumer's on_install to refill them. Idempotent; failures
-      // are logged, never fatal to the provider's own deploy.
-      const republish = await republishStaticWebConsumers({
-        providerModuleId: moduleId,
-        manifest,
-        db,
-      });
-      if (republish.republished.length > 0) {
-        log.success(
-          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
-        );
-      }
-      for (const failure of republish.failures) {
-        log.warn(
-          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
-        );
-      }
+      // Whatever this module provides, the consumers that were already here
+      // never got to ask it for anything. Re-run them so they register through
+      // the path that worked the first time (design D7).
+      await backfillArrivedProvider(moduleId, db);
 
       log.success(`Module '${moduleId}' deployed successfully`);
       return {

package/src/services/provider-arrival.test.ts

@@ -0,0 +1,241 @@
+import { describe, expect, it } from 'bun:test';
+import type { RunNamedHookResult } from '../hooks/run-named-hook';
+import type { HookLogger } from '../hooks/types';
+import type { ModuleManifest } from '../manifest/schema';
+import {
+  type ConsumerCandidate,
+  planProviderBackfill,
+  runProviderBackfill,
+} from './provider-arrival';
+
+/**
+ * The pure half of provider arrival: which consumers get re-run, and which are
+ * skipped and why. All of it is decided without a database, a hook runner, or a
+ * deployed anything, which is the point of the split.
+ */
+
+function manifest(input: { requires?: string[]; optional?: string[] }): ModuleManifest {
+  return {
+    requires: { capabilities: (input.requires ?? []).map((name) => ({ name, version: '1.0.0' })) },
+    optional: { capabilities: (input.optional ?? []).map((name) => ({ name, version: '1.0.0' })) },
+  } as unknown as ModuleManifest;
+}
+
+const consumer = (
+  moduleId: string,
+  caps: { requires?: string[]; optional?: string[] },
+  state = 'VERIFIED',
+): ConsumerCandidate => ({ moduleId, manifest: manifest(caps), state });
+
+describe('planProviderBackfill', () => {
+  it('re-runs consumers of the capabilities the arriving provider actually provides', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [
+        consumer('caddy', { requires: ['firewall'] }),
+        consumer('forgejo', { requires: ['public_web'] }),
+      ],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['caddy']);
+  });
+
+  /**
+   * `optional` is the edge `remove-guard.ts` already counts, and it is the one
+   * the field was added to express — "this hook will use monitoring if it is
+   * there" describes exactly a module with something to gain the moment the
+   * provider appears. Counting only `requires` would leave it unregistered.
+   */
+  it('includes an OPTIONAL dependent, not only a required one', () => {
+    const plan = planProviderBackfill(
+      'technitium',
+      ['dns_internal'],
+      [consumer('caddy-internal', { optional: ['dns_internal'] })],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['caddy-internal']);
+    expect(plan[0]?.skip).toBeUndefined();
+  });
+
+  it('never treats the provider as its own consumer', () => {
+    // A module that both provides and requires a capability would otherwise
+    // have its on_install run a second time inside the deploy that just ran it.
+    const plan = planProviderBackfill(
+      'caddy',
+      ['public_web'],
+      [
+        consumer('caddy', { requires: ['public_web', 'firewall'] }),
+        consumer('forgejo', { requires: ['public_web'] }),
+      ],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['forgejo']);
+  });
+
+  it('skips a consumer in a pre-deploy state, and says so rather than dropping it', () => {
+    // Capabilities are registered at IMPORT, not deploy, so an imported module
+    // has never resolved anything and has nothing to re-register.
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [
+        consumer('imported', { requires: ['firewall'] }, 'IMPORTED'),
+        consumer('validated', { requires: ['firewall'] }, 'VALIDATED'),
+        consumer('configured', { requires: ['firewall'] }, 'CONFIGURED'),
+      ],
+    );
+
+    expect(plan.map((t) => t.skip)).toEqual(['not-deployed', 'not-deployed', 'not-deployed']);
+  });
+
+  it('skips a PAUSED consumer separately from a never-deployed one', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [consumer('paused', { requires: ['firewall'] }, 'PAUSED')],
+    );
+
+    expect(plan[0]?.skip).toBe('paused');
+  });
+
+  it('names every capability the consumer takes from this provider, once', () => {
+    const plan = planProviderBackfill(
+      'greenwave',
+      ['firewall', 'dhcp_server'],
+      [consumer('caddy', { requires: ['firewall'], optional: ['dhcp_server'] })],
+    );
+
+    expect(plan).toHaveLength(1);
+    expect(plan[0]?.capabilityNames).toEqual(['dhcp_server', 'firewall']);
+  });
+
+  it('is empty for a module that provides nothing', () => {
+    expect(
+      planProviderBackfill('forgejo', [], [consumer('caddy', { requires: ['firewall'] })]),
+    ).toEqual([]);
+  });
+
+  it('is ordered by consumer id, so a failure is reproducible', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [consumer('zulu', { requires: ['firewall'] }), consumer('alpha', { requires: ['firewall'] })],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['alpha', 'zulu']);
+  });
+});
+
+const silentLogger = (): HookLogger & { warnings: string[] } => {
+  const warnings: string[] = [];
+  return {
+    warnings,
+    info: () => {},
+    warn: (m: string) => warnings.push(m),
+    error: () => {},
+    success: () => {},
+    debug: () => {},
+  } as unknown as HookLogger & { warnings: string[] };
+};
+
+const ok = (): RunNamedHookResult => ({ success: true }) as RunNamedHookResult;
+const fails = (error: string): RunNamedHookResult =>
+  ({ success: false, error }) as RunNamedHookResult;
+
+describe('runProviderBackfill', () => {
+  /**
+   * The property the whole thing exists for. Stopping at the first failure
+   * would leave the remaining consumers unregistered against a provider that is
+   * now live — the same gap, just narrower.
+   */
+  it('attempts every consumer even after one fails, and names each failure', async () => {
+    const attempted: string[] = [];
+    const result = await runProviderBackfill(
+      'iptables',
+      [
+        { consumerId: 'alpha', capabilityNames: ['firewall'] },
+        { consumerId: 'bravo', capabilityNames: ['firewall'] },
+        { consumerId: 'charlie', capabilityNames: ['firewall'] },
+      ],
+      {} as never,
+      silentLogger(),
+      async (id) => {
+        attempted.push(id);
+        return id === 'bravo' ? fails('ssh timed out') : ok();
+      },
+    );
+
+    expect(attempted).toEqual(['alpha', 'bravo', 'charlie']);
+    expect(result.rerun).toEqual(['alpha', 'charlie']);
+    expect(result.failures).toEqual([{ consumerId: 'bravo', error: 'ssh timed out' }]);
+  });
+
+  it('names the consumer and the retry command in the warning an operator reads', async () => {
+    const logger = silentLogger();
+    await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'bravo', capabilityNames: ['firewall'] }],
+      {} as never,
+      logger,
+      async () => fails('ssh timed out'),
+    );
+
+    expect(logger.warnings.join('\n')).toContain('bravo');
+    expect(logger.warnings.join('\n')).toContain('celilo module deploy bravo');
+  });
+
+  it('does not run a skipped consumer at all', async () => {
+    const attempted: string[] = [];
+    const result = await runProviderBackfill(
+      'iptables',
+      [
+        { consumerId: 'paused', capabilityNames: ['firewall'], skip: 'paused' },
+        { consumerId: 'fresh', capabilityNames: ['firewall'], skip: 'not-deployed' },
+      ],
+      {} as never,
+      silentLogger(),
+      async (id) => {
+        attempted.push(id);
+        return ok();
+      },
+    );
+
+    expect(attempted).toEqual([]);
+    expect(result.skipped).toEqual([
+      { consumerId: 'paused', reason: 'paused' },
+      { consumerId: 'fresh', reason: 'not-deployed' },
+    ]);
+  });
+
+  /**
+   * `runNamedHook` reports a paused module as a plain success, so trusting the
+   * flag alone would log a re-registration that never happened — the silence
+   * this change exists to end, reintroduced one layer down.
+   */
+  it('reads skippedPaused rather than trusting success, for a module paused mid-dispatch', async () => {
+    const result = await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'racer', capabilityNames: ['firewall'] }],
+      {} as never,
+      silentLogger(),
+      async () => ({ success: true, skippedPaused: true }) as RunNamedHookResult,
+    );
+
+    expect(result.rerun).toEqual([]);
+    expect(result.skipped).toEqual([{ consumerId: 'racer', reason: 'paused' }]);
+  });
+
+  it('does not count a consumer with no on_install as re-registered', async () => {
+    const result = await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'hookless', capabilityNames: ['firewall'] }],
+      {} as never,
+      silentLogger(),
+      async () => ({ success: true, notDefined: true }) as RunNamedHookResult,
+    );
+
+    expect(result.rerun).toEqual([]);
+    expect(result.failures).toEqual([]);
+  });
+});