@celilo/cli 1.6.0 → 1.7.0

package/src/cli/completion.ts

@@ -325,7 +325,15 @@ export async function getCompletions(words: string[], current: number): Promise<
   }
 
   if (command === 'service' && currentIndex === 1) {
-    const subcommands = ['add', 'list', 'verify', 'reconfigure', 'remove', 'config'];
+    const subcommands = [
+      'add',
+      'list',
+      'verify',
+      'reconfigure',
+      'remove',
+      'config',
+      'set-credentials',
+    ];
     return filterSuggestions(subcommands, args[1] || '');
   }
 
@@ -356,6 +364,13 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(serviceIds, args[2] || '');
   }
 
+  // Service set-credentials - complete with service IDs
+  if (command === 'service' && args[1] === 'set-credentials' && currentIndex === 2) {
+    const services = await listContainerServices();
+    const serviceIds = services.map((s) => s.serviceId);
+    return filterSuggestions(serviceIds, args[2] || '');
+  }
+
   // Service config operations
   if (command === 'service' && args[1] === 'config' && currentIndex === 2) {
     const operations = ['get', 'set'];

package/src/cli/index.ts

@@ -109,6 +109,7 @@ import { handleServiceConfigSet } from './commands/service-config-set';
 import { handleServiceList } from './commands/service-list';
 import { handleServiceReconfigure } from './commands/service-reconfigure';
 import { handleServiceRemove } from './commands/service-remove';
+import { handleServiceSetCredentials } from './commands/service-set-credentials';
 import { handleServiceVerify } from './commands/service-verify';
 import { handleStatus } from './commands/status';
 import { handleSubscribersAdd } from './commands/subscribers-add';
@@ -721,6 +722,7 @@ Subcommands:
     Options:
       --zone <zone>     Filter by network zone
   verify <service-id>   Re-verify a container service connection
+  set-credentials <service-id>  Update a provider endpoint or API credential
   reconfigure <service-id>  Re-run configuration interview (change template, storage, etc.)
   remove <id>           Remove a container service
     Options:
@@ -751,6 +753,9 @@ Examples:
   # Verify a service connection
   celilo service verify proxmox-home-lab
 
+  # Move a Proxmox endpoint while retaining its existing token
+  celilo service set-credentials proxmox-home-lab --api-url https://10.77.20.50:8006
+
   # Get service configuration
   celilo service config get proxmox-home-lab
   celilo service config get proxmox-home-lab name
@@ -1750,6 +1755,10 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleServiceVerify(parsed.args, parsed.flags);
     }
 
+    if (parsed.subcommand === 'set-credentials') {
+      return handleServiceSetCredentials(parsed.args, parsed.flags);
+    }
+
     if (parsed.subcommand === 'reconfigure') {
       return handleServiceReconfigure(parsed.args, parsed.flags);
     }

package/src/db/client.ts

@@ -4,8 +4,8 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { BUSY_TIMEOUT_MS, ensureWalMode } from '@celilo/event-bus/wal';
 import { drizzle } from 'drizzle-orm/bun-sqlite';
-import { migrate } from 'drizzle-orm/bun-sqlite/migrator';
 import { getDbPath } from '../config/paths';
+import { runMigrationsOn } from './migrate';
 import * as schema from './schema';
 
 /**
@@ -83,15 +83,17 @@ export function createDbClient(config?: Partial<DatabaseConfig>) {
   // idempotent: it applies every migration newer than the latest recorded in
   // `__drizzle_migrations` and no-ops once current.
   //
-  // One-time caveat (ISS-0100): an existing DB from the hand-list era has a
-  // frozen `__drizzle_migrations` watermark; it must be remediated by hand
-  // (stamp the watermark to the latest migration + create any missing table)
-  // BEFORE this code opens it, or migrate() re-runs already-applied migrations
-  // and throws. `celilo system doctor` (checkSchemaDrift) detects the drift.
+  // A DB from the hand-list era has a frozen `__drizzle_migrations` watermark,
+  // so drizzle re-runs already-applied migrations and throws (celilo#169).
+  // runMigrationsOn repairs that itself where the schema is already complete.
+  // It has to happen HERE and not only in `celilo system migrate`, because
+  // that command reaches its own repair through getDb() — this line — and so
+  // would die before getting there. A PARTIALLY applied schema still throws
+  // and still needs a human. `celilo system doctor` (checkSchemaDrift) detects
+  // the drift.
   if (!readonly) {
     try {
-      const migrationsFolder = findMigrationsFolder();
-      migrate(db, { migrationsFolder });
+      runMigrationsOn(db);
     } catch (error) {
       console.error('Failed to run migrations:', error);
       throw error;

package/src/db/migrate.test.ts

@@ -0,0 +1,147 @@
+/**
+ * The frozen-watermark recurrence gate (celilo#169).
+ *
+ * The state under test is one no correct deploy can produce, so it is seeded
+ * by hand rather than reached: a database written by a celilo from the
+ * imperative hand-list era, where schema changes were applied directly and
+ * `__drizzle_migrations` never recorded them. Its ledger therefore remembers
+ * an old migration while the tables and columns of every later one are already
+ * present.
+ *
+ * That is the carve-out CLAUDE.md draws around seeding state: deploying
+ * anything cannot reproduce this row, because current celilo has recorded
+ * every migration it applied since ISS-0100 made drizzle authoritative. A
+ * suite that starts from an empty database can only ever prove the forward
+ * invariant, and says nothing about the installed base.
+ *
+ * What made it a hazard: drizzle's migrator is watermark-only. It re-runs
+ * every migration newer than the newest ledger row, so the first `ALTER TABLE
+ * ... ADD` dies on `duplicate column name`, the transaction rolls back, and
+ * the throw happens inside `createDbClient` — so EVERY celilo command on that
+ * box fails at database open, not just a migrate. celilo-mgr was remediated by
+ * hand once. This gate is what stops the next one needing a runbook.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type DbClient, createDbClient } from './client';
+import { runMigrationsOn } from './migrate';
+import { findSchemaDrift } from './schema-introspection';
+
+describe('runMigrationsOn — a database from the hand-list era', () => {
+  const paths: string[] = [];
+
+  const freshDb = (): { db: DbClient; path: string } => {
+    const path = join(tmpdir(), `celilo-migrate-test-${Bun.nanoseconds()}.db`);
+    paths.push(path);
+    return { db: createDbClient({ path }), path };
+  };
+
+  afterEach(() => {
+    for (const path of paths.splice(0)) {
+      for (const suffix of ['', '-wal', '-shm']) {
+        rmSync(`${path}${suffix}`, { force: true });
+      }
+    }
+  });
+
+  /**
+   * Freeze the ledger to its oldest entry, leaving the schema fully applied.
+   * This is the hand-list-era shape: the objects exist, the ledger has
+   * forgotten who made them.
+   */
+  const freezeWatermark = (db: DbClient): void => {
+    db.$client.run(
+      'DELETE FROM `__drizzle_migrations` WHERE created_at > (SELECT MIN(created_at) FROM `__drizzle_migrations`)',
+    );
+  };
+
+  const appliedCount = (db: DbClient): number =>
+    db.$client.query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`').get()
+      ?.c ?? 0;
+
+  test('converges instead of dying on the first already-applied statement', () => {
+    const { db } = freshDb();
+    const migrationCount = appliedCount(db);
+    freezeWatermark(db);
+    expect(appliedCount(db)).toBe(1);
+
+    // Red before the ledger repair: drizzle re-runs 0001 and throws
+    // "duplicate column name: role", leaving the ledger frozen.
+    expect(() => runMigrationsOn(db)).not.toThrow();
+
+    expect(appliedCount(db)).toBe(migrationCount);
+  });
+
+  test('leaves the schema whole, so the drift detector goes green', () => {
+    const { db } = freshDb();
+    freezeWatermark(db);
+
+    runMigrationsOn(db);
+
+    const drift = findSchemaDrift(db.$client);
+    expect(drift.missingTables).toEqual([]);
+    expect(drift.missingColumns).toEqual([]);
+  });
+
+  test('is idempotent — a second pass applies nothing and still converges', () => {
+    const { db } = freshDb();
+    freezeWatermark(db);
+    runMigrationsOn(db);
+    const afterBaseline = appliedCount(db);
+
+    runMigrationsOn(db);
+
+    expect(appliedCount(db)).toBe(afterBaseline);
+  });
+
+  /**
+   * The repair must not become a blanket "assume it already ran". It fires only
+   * where the answer is unambiguous — the declared schema is entirely present,
+   * so every migration plainly did run and the ledger is what is wrong. A
+   * PARTIALLY applied schema is the genuinely hard case, and the one celilo-mgr
+   * was actually in: it carried 0011's column and not 0010's table. Stamping
+   * there would record migrations that never ran and bury the missing schema
+   * for good, so it keeps failing and a human decides.
+   */
+  test('refuses to stamp when the schema is only partly there', () => {
+    const { db } = freshDb();
+    freezeWatermark(db);
+    db.$client.run('DROP TABLE `dns_registrations`');
+
+    expect(() => runMigrationsOn(db)).toThrow();
+    // The ledger is left exactly as found, so the drift is still diagnosable.
+    expect(appliedCount(db)).toBe(1);
+  });
+
+  /**
+   * The path that actually matters. Every celilo command opens the database
+   * through createDbClient, which migrates on open, so a frozen watermark
+   * failed there rather than anywhere an operator could aim a fix at — and
+   * `celilo system migrate`, the command whose whole job is repairing this,
+   * reached its own repair through the same open and died first.
+   */
+  test('repairs on database open, not just when migrate is called by hand', () => {
+    const { db, path } = freshDb();
+    const migrationCount = appliedCount(db);
+    freezeWatermark(db);
+    db.$client.close();
+
+    const reopened = createDbClient({ path });
+
+    expect(appliedCount(reopened)).toBe(migrationCount);
+    expect(findSchemaDrift(reopened.$client).missingTables).toEqual([]);
+  });
+
+  test('a healthy database is untouched by the fallback', () => {
+    const { db } = freshDb();
+    const before = appliedCount(db);
+
+    runMigrationsOn(db);
+
+    expect(appliedCount(db)).toBe(before);
+    expect(findSchemaDrift(db.$client).missingTables).toEqual([]);
+  });
+});

package/src/db/migrate.ts

@@ -1,14 +1,82 @@
+import type { Database } from 'bun:sqlite';
 import { migrate } from 'drizzle-orm/bun-sqlite/migrator';
+import { readMigrationFiles } from 'drizzle-orm/migrator';
 import { type DbClient, closeDb, createDbClient, findMigrationsFolder } from './client';
+import { findSchemaDrift } from './schema-introspection';
+
+/**
+ * Record every migration past the ledger's watermark as applied, running none
+ * of them. Only safe when the caller has already established that the schema
+ * the code declares is entirely present.
+ *
+ * Replaying the statements instead would be wrong, and quietly so. Migrations
+ * are not idempotent: `0021_dns_registration_consumers` rebuilds a table by
+ * copying it aside, `DROP TABLE`-ing the original and renaming the copy over
+ * it. Run that against a schema that is already current and it drops a live
+ * table. Skipping the statements that fail with "already exists" does not save
+ * you either, because `DROP` and `INSERT ... SELECT` do not fail that way.
+ *
+ * So the ledger is corrected and the schema is left alone.
+ */
+function stampLedgerAsApplied(sqlite: Database, migrationsFolder: string): void {
+  const newest = sqlite
+    .query<{ created_at: number }, []>(
+      'SELECT created_at FROM `__drizzle_migrations` ORDER BY created_at DESC LIMIT 1',
+    )
+    .get();
+  const watermark = Number(newest?.created_at ?? 0);
+
+  sqlite.run('BEGIN');
+  try {
+    for (const migration of readMigrationFiles({ migrationsFolder })) {
+      if (migration.folderMillis <= watermark) continue;
+      sqlite.run('INSERT INTO `__drizzle_migrations` ("hash", "created_at") VALUES (?, ?)', [
+        migration.hash,
+        migration.folderMillis,
+      ]);
+    }
+    sqlite.run('COMMIT');
+  } catch (error) {
+    sqlite.run('ROLLBACK');
+    throw error;
+  }
+}
 
 /**
  * Apply pending drizzle migrations to an open DB. Idempotent — drizzle applies
  * only migrations newer than the latest recorded in `__drizzle_migrations`.
  * The single migration mechanism (ISS-0100); createDbClient also calls this
  * shape on open (auto-migrate).
+ *
+ * The stock migrator runs first and handles every database celilo has written
+ * since ISS-0100, so a healthy box takes exactly the path it took before.
+ *
+ * It fails on one database celilo did not write: one from the imperative
+ * hand-list era, where schema changes were applied directly and
+ * `__drizzle_migrations` never recorded them. Its ledger remembers an old
+ * migration while the objects of every later one are already there, and
+ * drizzle — being watermark-only — re-runs them and dies on the first
+ * `ALTER TABLE ... ADD`. The throw happens inside `createDbClient`, so every
+ * celilo command on that box fails at database open. celilo-mgr, the one box
+ * in that state, was remediated by hand (celilo#169); this is so the next one
+ * is not.
+ *
+ * The repair is only attempted when the schema the code declares is ALREADY
+ * COMPLETE, because that is the one case with an unambiguous answer: every
+ * migration has plainly run, so the ledger is what is wrong. A database missing
+ * some of it is the genuinely hard case — celilo-mgr had 0011's column and not
+ * 0010's table — and there is no safe automatic answer, so it keeps failing
+ * with drizzle's own error and a human decides.
  */
 export function runMigrationsOn(db: DbClient): void {
-  migrate(db, { migrationsFolder: findMigrationsFolder() });
+  const migrationsFolder = findMigrationsFolder();
+  try {
+    migrate(db, { migrationsFolder });
+  } catch (error) {
+    const drift = findSchemaDrift(db.$client);
+    if (drift.missingTables.length > 0 || drift.missingColumns.length > 0) throw error;
+    stampLedgerAsApplied(db.$client, migrationsFolder);
+  }
 }
 
 /**

package/src/hooks/capability-loader.test.ts

@@ -29,6 +29,17 @@ export default function registerHost(context) {
 }
 `;
 
+const TEST_DHCP_SERVER_MODULE = `
+export default function createDhcpServer(context) {
+  return {
+    async setDnsServers() {},
+    async getDnsServers() { return [context.config.marker]; },
+    async setDomainName() {},
+    async getDomainName() { return context.config.marker; },
+  };
+}
+`;
+
 describe('Capability Loader', () => {
   let db: DbClient;
   let tempDir: string;
@@ -97,6 +108,50 @@ describe('Capability Loader', () => {
     expect(result.dns_registrar).toBeTruthy();
   });
 
+  test('prefers a provider explicitly scoped to the well-known capability zone', async () => {
+    for (const moduleId of ['upstream-dhcp', 'internal-dhcp']) {
+      const modulePath = join(tempDir, moduleId);
+      const scriptsDir = join(modulePath, 'scripts');
+      mkdirSync(scriptsDir, { recursive: true });
+      writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_DHCP_SERVER_MODULE);
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('${moduleId}', '${moduleId}', '1.0.0', '${modulePath}', '{}')`,
+      );
+      upsertModuleConfig(db, moduleId, 'marker', moduleId);
+    }
+
+    // Insert the zone-agnostic upstream provider first to prove selection is
+    // policy-driven rather than database-order-driven.
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('upstream-dhcp', 'dhcp_server', '1.0.0', '{}', NULL, unixepoch())`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('internal-dhcp', 'dhcp_server', '1.0.0', '{}', '["internal"]', unixepoch())`,
+    );
+
+    const result = await loadCapabilityFunctions('dns-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as { getDomainName(): Promise<string> };
+    expect(await dhcp.getDomainName()).toBe('internal-dhcp');
+  });
+
+  test('falls back to a zone-agnostic provider when no explicit zone provider exists', async () => {
+    const modulePath = join(tempDir, 'upstream-dhcp');
+    const scriptsDir = join(modulePath, 'scripts');
+    mkdirSync(scriptsDir, { recursive: true });
+    writeFileSync(join(scriptsDir, 'dhcp-server-functions.ts'), TEST_DHCP_SERVER_MODULE);
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('upstream-dhcp', 'upstream-dhcp', '1.0.0', '${modulePath}', '{}')`,
+    );
+    db.$client.run(
+      `INSERT INTO capabilities (module_id, capability_name, version, data, zones, registered_at) VALUES ('upstream-dhcp', 'dhcp_server', '1.0.0', '{}', NULL, unixepoch())`,
+    );
+    upsertModuleConfig(db, 'upstream-dhcp', 'marker', 'upstream-dhcp');
+
+    const result = await loadCapabilityFunctions('dns-consumer', db, noopLogger);
+    const dhcp = result.dhcp_server as { getDomainName(): Promise<string> };
+    expect(await dhcp.getDomainName()).toBe('upstream-dhcp');
+  });
+
   test('injects a read-only web_routes view into the public_web provider own hooks (ISS-0035)', async () => {
     const modulePath = join(tempDir, 'caddy');
     mkdirSync(modulePath, { recursive: true });

package/src/hooks/capability-loader.ts

@@ -27,6 +27,8 @@ import type {
   TrustedSourceStore,
 } from '@celilo/capabilities';
 import { and, eq } from 'drizzle-orm';
+import { selectCapabilityProvider } from '../capabilities/lookup';
+import { WELL_KNOWN_CAPABILITIES } from '../capabilities/well-known';
 import type { DbClient } from '../db/client';
 import {
   NETWORK_ZONES,
@@ -279,7 +281,20 @@ export async function loadCapabilityFunctions(
       continue;
     }
 
-    const capability = allProviders[0];
+    // A well-known capability's required zone is also its runtime selection
+    // context. Prefer a provider that explicitly serves that zone, then fall
+    // back to a zone-agnostic provider. Without this, multiple DHCP providers
+    // (for example an upstream router plus an internal LAN server) are selected
+    // by database insertion order and a consumer can reconfigure the wrong
+    // network boundary.
+    const selectionZone = WELL_KNOWN_CAPABILITIES[capName]?.required_zone;
+    const capability = selectCapabilityProvider(allProviders, selectionZone);
+    if (!capability) {
+      debugLog(
+        `${capName}: no provider serves required zone ${selectionZone ?? '(unspecified)'}, skipping`,
+      );
+      continue;
+    }
     debugLog(`${capName}: found provider module ${capability.moduleId}`);
 
     const providerModule = db

package/src/module/import.ts

@@ -300,7 +300,8 @@ export function moduleExists(moduleId: string, db = getDb()): boolean {
  * Validate well-known capabilities
  *
  * Policy function - checks if module's well-known capabilities are valid:
- * 1. No other module provides the same well-known capability (uniqueness)
+ * 1. No other module provides the same well-known capability in an
+ *    overlapping scope (zone-aware uniqueness)
  * 2. Module's zone matches capability's required zone (zone enforcement)
  *
  * @param manifest - Module manifest
@@ -321,16 +322,30 @@ export async function validateWellKnownCapabilities(
 
     const wellKnown = getWellKnownCapability(capability.name);
 
-    // Check 1: Capability uniqueness - only one module can provide this capability
+    // Check 1: Capability uniqueness within an overlapping scope. An explicit
+    // zone-scoped provider may coexist with a zone-agnostic fallback because
+    // lookup deterministically prefers the explicit match. Two agnostic
+    // providers, or two explicit providers sharing a zone, remain ambiguous.
     const existingCapability = await db
       .select()
       .from(capabilities)
       .where(eq(capabilities.capabilityName, capability.name))
       .all();
 
-    if (existingCapability.length > 0) {
-      const conflictingModule = existingCapability[0];
-      return `Well-known capability '${capability.name}' is already provided by module '${conflictingModule.moduleId}'. A home lab can only have one module providing this capability. Remove '${conflictingModule.moduleId}' before importing this module.`;
+    const newZones = capability.zones ?? null;
+    const conflictingModule = existingCapability.find((candidate) => {
+      const existingZones = candidate.zones ?? null;
+
+      if (newZones === null || existingZones === null) {
+        return newZones === null && existingZones === null;
+      }
+
+      return newZones.some((zone) => existingZones.includes(zone));
+    });
+
+    if (conflictingModule) {
+      const scope = newZones ? ` zone(s) ${newZones.join(', ')}` : ' the zone-agnostic scope';
+      return `Well-known capability '${capability.name}' is already provided in${scope} by module '${conflictingModule.moduleId}'. Remove '${conflictingModule.moduleId}' or use a non-overlapping explicit zone scope before importing this module.`;
     }
 
     // Check 2: Zone enforcement - module must be in the correct zone

package/src/policy/module-business-baseline.ts

@@ -248,12 +248,6 @@ export const CAPABILITY_NAME_BASELINE: readonly CapabilityNameRow[] = [
     count: 2,
     why: "S16 — two more copies of S15's decision; fixing S15 removes all three (#938)",
   },
-  {
-    file: 'apps/celilo/src/services/public-web-republish.ts',
-    capability: 'public_web',
-    count: 1,
-    why: "S2 — encodes caddy's redeploy behaviour; generalise to a provider-declared re-assert signal (#945)",
-  },
   {
     file: 'apps/celilo/src/services/zone-policy.ts',
     capability: 'public_web',
@@ -391,11 +385,6 @@ export const SERVICE_FILENAME_BASELINE: readonly ServiceFilenameRow[] = [
     capability: 'firewall',
     why: 'S8 — core reaching into one provider implementation (#941)',
   },
-  {
-    file: 'apps/celilo/src/services/public-web-republish.ts',
-    capability: 'public_web',
-    why: "S2 — named for one provider's redeploy behaviour (#945)",
-  },
 ];
 
 export const PROVIDER_LITERAL_BASELINE: readonly ProviderLiteralRow[] = [

package/src/services/alerting/monitors.ts

@@ -214,7 +214,59 @@ export function ensureInboundSubscriber(bus: SubscriberRegistrar): void {
   });
 }
 
-export function deleteMonitor(db: DbClient, monitorId: string, now: Date): void {
-  resolveMonitorAlerts(db, monitorId, now);
+/** A live alert about to be deleted along with the monitor that owns it. */
+export interface DroppedAlert {
+  key: string;
+  message: string;
+}
+
+/**
+ * Delete a monitor, and report the live alerts that go with it.
+ *
+ * The alerts are DELETED, not resolved. `alerts.monitorId` is
+ * `on delete cascade`, so the row goes the moment the monitor does. This used
+ * to call `resolveMonitorAlerts` first; that write was unreachable — the very
+ * next statement dropped the same rows, and nothing read them in between, so
+ * the resolved state existed for the duration of one statement. Deleted rather
+ * than restored, because resolving properly would need the alert rows to
+ * outlive their monitor, which the FK forbids and which no reader wants:
+ * `resolvedAt` is only ever read as a liveness predicate (`ack.ts`), never
+ * reported. Do not put the call back without changing the FK first.
+ *
+ * What IS worth keeping is what was lost, which is why the live alerts are
+ * returned. A monitor dropped while holding a firing alert takes a real
+ * failure and the coverage of it away together, and a caller that only names
+ * the monitor cannot tell an operator what stopped being watched.
+ */
+export function deleteMonitor(db: DbClient, monitorId: string): DroppedAlert[] {
+  const dropped = db
+    .select({ key: alerts.key, message: alerts.message })
+    .from(alerts)
+    .where(and(eq(alerts.monitorId, monitorId), isNotNull(alerts.activeKey)))
+    .all();
+
   db.delete(monitors).where(eq(monitors.id, monitorId)).run();
+  return dropped;
+}
+
+/**
+ * Drop the `module_hook` monitor belonging to a module that is going away.
+ *
+ * Called from the removal path rather than expressed as a foreign key, because
+ * `monitors.target` cannot carry one: it holds a module id for `module_hook`
+ * and an audit check name for `builtin_check`, and SQLite has no conditional
+ * reference. Splitting the table to get the constraint would need a synthetic
+ * monitor identity for `alerts.monitorId` — the trade the file header already
+ * weighs and declines.
+ *
+ * Deleting cascades the monitor's alerts away (`alerts.monitorId` is
+ * `on delete cascade`), which is what releases anything they were suppressing.
+ * They are deleted, not resolved — see `deleteMonitor`. Returns what was live
+ * so the caller can say what stopped being watched, or null if the module had
+ * no monitor.
+ */
+export function deleteMonitorForModule(db: DbClient, moduleId: string): DroppedAlert[] | null {
+  const monitor = findMonitor(db, 'module_hook', moduleId);
+  if (!monitor) return null;
+  return deleteMonitor(db, monitor.id);
 }

package/src/services/alerting/sweep-runner.ts

@@ -23,6 +23,7 @@ import type { DbClient } from '../../db/client';
 import type { Alert, Monitor } from '../../db/schema';
 import { MONITOR_INTERVAL_FLOOR_MINUTES } from '../cadence';
 import { isScheduled, loadModuleHealthCadences } from './health-cadence';
+import { type DroppedAlert, deleteMonitor } from './monitors';
 import type { NotifyDeps, NotifyOutcome } from './notifier';
 import { deliverDeferred, notifyAlert } from './notifier';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
@@ -102,6 +103,19 @@ export interface SweepReport {
    * former, because nothing ever reached the daemon.
    */
   failures: string[];
+  /**
+   * Modules whose `module_hook` monitor was dropped because the module itself
+   * is gone, and the live alerts each one took with it.
+   *
+   * The alerts are DELETED by the monitor's cascade, not resolved, so a firing
+   * check and the coverage of it disappear in the same instant with nothing
+   * else recording either. A bare module name is not enough to act on: the row
+   * that mattered on the fleet was holding `Cannot reach router: Router login
+   * failed`, and `1 stranded-dropped (greenwave)` would not have told anyone
+   * that a router had stopped being checked. Same reason `noPolicy`, `skipped`
+   * and `failures` all name their subject rather than counting it.
+   */
+  strandedDropped: { moduleId: string; alerts: DroppedAlert[] }[];
 }
 
 /**
@@ -129,6 +143,7 @@ export async function runSweep(
     noPolicy: [],
     skipped: [],
     failures: [],
+    strandedDropped: [],
   };
 
   // 1. Run due monitors.
@@ -139,8 +154,30 @@ export async function runSweep(
   // manifest could never reach an existing install (design.md D2/D8). A
   // `builtin_check` has no module and no manifest, so its row is the config.
   const cadences = loadModuleHealthCadences(db);
+
+  // Reconcile away monitors whose module is gone, before anything tries to run
+  // them. `loadModuleHealthCadences` holds every module, so a miss here means
+  // no module row — and a `module_hook` monitor without one is unschedulable
+  // forever: its cadence resolves to null, `isScheduled` says false, and the
+  // sweep never selects it again. Anything it left firing would sit there with
+  // no path back to `resolved`, suppressing every alert it is an ancestor of
+  // (celilo#1029).
+  //
+  // The removal path deletes the monitor itself, so this only fires for rows a
+  // celilo without that fix left behind, or a removal that died between the two
+  // deletes. Same stance `setMonitorEnabled` already takes: a monitor that will
+  // never report again must not hold live alerts.
+  const stranded = monitors.filter((m) => m.kind === 'module_hook' && !cadences.has(m.target));
+  for (const monitor of stranded) {
+    report.strandedDropped.push({
+      moduleId: monitor.target,
+      alerts: deleteMonitor(db, monitor.id),
+    });
+  }
+  const active = stranded.length > 0 ? monitors.filter((m) => !stranded.includes(m)) : monitors;
+
   const due = selectDueMonitors(
-    monitors.map((m) => {
+    active.map((m) => {
       if (m.kind !== 'module_hook') {
         return {
           id: m.id,

package/src/services/consumer-cleanup.ts

@@ -31,10 +31,12 @@ import { deleteTrustedSourcesForModule } from './trusted-sources';
  * nothing minted on anyone's behalf. Capabilities are registered at IMPORT, not
  * deploy, so the `capabilities` table routinely names providers that were never
  * deployed. The same predicate `remove-guard.ts` uses to decide a module is not
- * a dependent — the guard and the cleanup must keep ONE definition of a live
- * provider (D8).
+ * a dependent — the guard, the cleanup and the provider-arrival backfill must
+ * keep ONE definition of a live module (D8). Exported rather than re-spelled:
+ * `module-remove.ts` had its own copy of the literal, and `provider-arrival.ts`
+ * would have been a third.
  */
-const PRE_DEPLOY_STATES = new Set(['IMPORTED', 'VALIDATED', 'CONFIGURED']);
+export const PRE_DEPLOY_STATES = new Set(['IMPORTED', 'VALIDATED', 'CONFIGURED']);
 
 export type CleanupSkipReason = 'paused' | 'not-deployed';