@celilo/cli 1.6.0 → 1.7.0

package/src/services/provider-arrival.test.ts

@@ -0,0 +1,241 @@
+import { describe, expect, it } from 'bun:test';
+import type { RunNamedHookResult } from '../hooks/run-named-hook';
+import type { HookLogger } from '../hooks/types';
+import type { ModuleManifest } from '../manifest/schema';
+import {
+  type ConsumerCandidate,
+  planProviderBackfill,
+  runProviderBackfill,
+} from './provider-arrival';
+
+/**
+ * The pure half of provider arrival: which consumers get re-run, and which are
+ * skipped and why. All of it is decided without a database, a hook runner, or a
+ * deployed anything, which is the point of the split.
+ */
+
+function manifest(input: { requires?: string[]; optional?: string[] }): ModuleManifest {
+  return {
+    requires: { capabilities: (input.requires ?? []).map((name) => ({ name, version: '1.0.0' })) },
+    optional: { capabilities: (input.optional ?? []).map((name) => ({ name, version: '1.0.0' })) },
+  } as unknown as ModuleManifest;
+}
+
+const consumer = (
+  moduleId: string,
+  caps: { requires?: string[]; optional?: string[] },
+  state = 'VERIFIED',
+): ConsumerCandidate => ({ moduleId, manifest: manifest(caps), state });
+
+describe('planProviderBackfill', () => {
+  it('re-runs consumers of the capabilities the arriving provider actually provides', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [
+        consumer('caddy', { requires: ['firewall'] }),
+        consumer('forgejo', { requires: ['public_web'] }),
+      ],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['caddy']);
+  });
+
+  /**
+   * `optional` is the edge `remove-guard.ts` already counts, and it is the one
+   * the field was added to express — "this hook will use monitoring if it is
+   * there" describes exactly a module with something to gain the moment the
+   * provider appears. Counting only `requires` would leave it unregistered.
+   */
+  it('includes an OPTIONAL dependent, not only a required one', () => {
+    const plan = planProviderBackfill(
+      'technitium',
+      ['dns_internal'],
+      [consumer('caddy-internal', { optional: ['dns_internal'] })],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['caddy-internal']);
+    expect(plan[0]?.skip).toBeUndefined();
+  });
+
+  it('never treats the provider as its own consumer', () => {
+    // A module that both provides and requires a capability would otherwise
+    // have its on_install run a second time inside the deploy that just ran it.
+    const plan = planProviderBackfill(
+      'caddy',
+      ['public_web'],
+      [
+        consumer('caddy', { requires: ['public_web', 'firewall'] }),
+        consumer('forgejo', { requires: ['public_web'] }),
+      ],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['forgejo']);
+  });
+
+  it('skips a consumer in a pre-deploy state, and says so rather than dropping it', () => {
+    // Capabilities are registered at IMPORT, not deploy, so an imported module
+    // has never resolved anything and has nothing to re-register.
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [
+        consumer('imported', { requires: ['firewall'] }, 'IMPORTED'),
+        consumer('validated', { requires: ['firewall'] }, 'VALIDATED'),
+        consumer('configured', { requires: ['firewall'] }, 'CONFIGURED'),
+      ],
+    );
+
+    expect(plan.map((t) => t.skip)).toEqual(['not-deployed', 'not-deployed', 'not-deployed']);
+  });
+
+  it('skips a PAUSED consumer separately from a never-deployed one', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [consumer('paused', { requires: ['firewall'] }, 'PAUSED')],
+    );
+
+    expect(plan[0]?.skip).toBe('paused');
+  });
+
+  it('names every capability the consumer takes from this provider, once', () => {
+    const plan = planProviderBackfill(
+      'greenwave',
+      ['firewall', 'dhcp_server'],
+      [consumer('caddy', { requires: ['firewall'], optional: ['dhcp_server'] })],
+    );
+
+    expect(plan).toHaveLength(1);
+    expect(plan[0]?.capabilityNames).toEqual(['dhcp_server', 'firewall']);
+  });
+
+  it('is empty for a module that provides nothing', () => {
+    expect(
+      planProviderBackfill('forgejo', [], [consumer('caddy', { requires: ['firewall'] })]),
+    ).toEqual([]);
+  });
+
+  it('is ordered by consumer id, so a failure is reproducible', () => {
+    const plan = planProviderBackfill(
+      'iptables',
+      ['firewall'],
+      [consumer('zulu', { requires: ['firewall'] }), consumer('alpha', { requires: ['firewall'] })],
+    );
+
+    expect(plan.map((t) => t.consumerId)).toEqual(['alpha', 'zulu']);
+  });
+});
+
+const silentLogger = (): HookLogger & { warnings: string[] } => {
+  const warnings: string[] = [];
+  return {
+    warnings,
+    info: () => {},
+    warn: (m: string) => warnings.push(m),
+    error: () => {},
+    success: () => {},
+    debug: () => {},
+  } as unknown as HookLogger & { warnings: string[] };
+};
+
+const ok = (): RunNamedHookResult => ({ success: true }) as RunNamedHookResult;
+const fails = (error: string): RunNamedHookResult =>
+  ({ success: false, error }) as RunNamedHookResult;
+
+describe('runProviderBackfill', () => {
+  /**
+   * The property the whole thing exists for. Stopping at the first failure
+   * would leave the remaining consumers unregistered against a provider that is
+   * now live — the same gap, just narrower.
+   */
+  it('attempts every consumer even after one fails, and names each failure', async () => {
+    const attempted: string[] = [];
+    const result = await runProviderBackfill(
+      'iptables',
+      [
+        { consumerId: 'alpha', capabilityNames: ['firewall'] },
+        { consumerId: 'bravo', capabilityNames: ['firewall'] },
+        { consumerId: 'charlie', capabilityNames: ['firewall'] },
+      ],
+      {} as never,
+      silentLogger(),
+      async (id) => {
+        attempted.push(id);
+        return id === 'bravo' ? fails('ssh timed out') : ok();
+      },
+    );
+
+    expect(attempted).toEqual(['alpha', 'bravo', 'charlie']);
+    expect(result.rerun).toEqual(['alpha', 'charlie']);
+    expect(result.failures).toEqual([{ consumerId: 'bravo', error: 'ssh timed out' }]);
+  });
+
+  it('names the consumer and the retry command in the warning an operator reads', async () => {
+    const logger = silentLogger();
+    await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'bravo', capabilityNames: ['firewall'] }],
+      {} as never,
+      logger,
+      async () => fails('ssh timed out'),
+    );
+
+    expect(logger.warnings.join('\n')).toContain('bravo');
+    expect(logger.warnings.join('\n')).toContain('celilo module deploy bravo');
+  });
+
+  it('does not run a skipped consumer at all', async () => {
+    const attempted: string[] = [];
+    const result = await runProviderBackfill(
+      'iptables',
+      [
+        { consumerId: 'paused', capabilityNames: ['firewall'], skip: 'paused' },
+        { consumerId: 'fresh', capabilityNames: ['firewall'], skip: 'not-deployed' },
+      ],
+      {} as never,
+      silentLogger(),
+      async (id) => {
+        attempted.push(id);
+        return ok();
+      },
+    );
+
+    expect(attempted).toEqual([]);
+    expect(result.skipped).toEqual([
+      { consumerId: 'paused', reason: 'paused' },
+      { consumerId: 'fresh', reason: 'not-deployed' },
+    ]);
+  });
+
+  /**
+   * `runNamedHook` reports a paused module as a plain success, so trusting the
+   * flag alone would log a re-registration that never happened — the silence
+   * this change exists to end, reintroduced one layer down.
+   */
+  it('reads skippedPaused rather than trusting success, for a module paused mid-dispatch', async () => {
+    const result = await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'racer', capabilityNames: ['firewall'] }],
+      {} as never,
+      silentLogger(),
+      async () => ({ success: true, skippedPaused: true }) as RunNamedHookResult,
+    );
+
+    expect(result.rerun).toEqual([]);
+    expect(result.skipped).toEqual([{ consumerId: 'racer', reason: 'paused' }]);
+  });
+
+  it('does not count a consumer with no on_install as re-registered', async () => {
+    const result = await runProviderBackfill(
+      'iptables',
+      [{ consumerId: 'hookless', capabilityNames: ['firewall'] }],
+      {} as never,
+      silentLogger(),
+      async () => ({ success: true, notDefined: true }) as RunNamedHookResult,
+    );
+
+    expect(result.rerun).toEqual([]);
+    expect(result.failures).toEqual([]);
+  });
+});

package/src/services/provider-arrival.ts

@@ -0,0 +1,213 @@
+/**
+ * Re-running a provider's consumers when that provider arrives
+ * (openspec/changes/capability-owned-tables, stage 1).
+ *
+ * celilo handled one side of the capability relationship generically and the
+ * other by hand. A consumer leaving goes through `consumer-cleanup.ts`, which
+ * finds every provider it used and calls each one's `on_consumer_removed` with
+ * no capability names in the dispatch. A provider ARRIVING had three
+ * hand-written pieces covering two capabilities, and `firewall` — which three
+ * modules provide — had none at all (celilo#1011).
+ *
+ * This is the mirror of `consumer-cleanup.ts`, and it is deliberately built the
+ * same way, down to sharing that file's `PRE_DEPLOY_STATES`.
+ *
+ * PULL, NOT PUSH (design D7). When a provider arrives, celilo re-runs the
+ * CONSUMERS' `on_install` and lets each consumer re-register through the path
+ * that worked the first time. It does NOT replay history into the provider by
+ * calling the provider's own hooks on a consumer's behalf. Two of the three
+ * pieces this replaces pushed, and one of them had already drifted:
+ * `backfillWebRouteDns` cannot go through `on_system_event`, because that hook
+ * concatenates `<hostname>.<zone>` and would corrupt an already-qualified name,
+ * so it reaches past the hook into `registerRecord` and now differs from the
+ * live path in ways nothing checks.
+ *
+ * Split plan/execute (Rule 10.4): which consumers, and why one is skipped, is
+ * pure and worth testing on its own. The rest is "run each hook and record what
+ * happened".
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../db/client';
+import { capabilities, modules } from '../db/schema';
+import { createConsoleLogger } from '../hooks/logger';
+import { type RunNamedHookResult, runNamedHook } from '../hooks/run-named-hook';
+import type { HookLogger } from '../hooks/types';
+import { type ModuleManifest, ModuleManifestSchema } from '../manifest/schema';
+import { PRE_DEPLOY_STATES } from './consumer-cleanup';
+
+export type BackfillSkipReason = 'paused' | 'not-deployed';
+
+export interface BackfillTarget {
+  /** The consumer module to re-run. */
+  consumerId: string;
+  /** Which of the arriving provider's capabilities it consumes — for the log line. */
+  capabilityNames: string[];
+  /** Set when the consumer will NOT be re-run. */
+  skip?: BackfillSkipReason;
+}
+
+export interface ConsumerCandidate {
+  moduleId: string;
+  manifest: ModuleManifest;
+  state: string;
+}
+
+/**
+ * Which consumers must be re-run now that `provider` is here.
+ *
+ * Pure. Sorted by consumer id so dispatch order is deterministic and a failure
+ * is reproducible.
+ *
+ * `requires` AND `optional`, which is the edge `remove-guard.ts` already counts
+ * and the one `optional` was added to express — "this hook will use monitoring
+ * if it is there" describes a module that has something to gain the moment the
+ * provider appears.
+ *
+ * The provider is never its own consumer. A module that both provides and
+ * requires a capability would otherwise have its `on_install` run a second time
+ * inside its own deploy, which just finished running it.
+ */
+export function planProviderBackfill(
+  provider: string,
+  providedCapabilities: Iterable<string>,
+  candidates: ConsumerCandidate[],
+): BackfillTarget[] {
+  const provided = new Set(providedCapabilities);
+  if (provided.size === 0) return [];
+
+  const targets: BackfillTarget[] = [];
+  for (const candidate of candidates) {
+    if (candidate.moduleId === provider) continue;
+
+    const consumed = new Set([
+      ...(candidate.manifest.requires?.capabilities ?? []).map((c) => c.name),
+      ...(candidate.manifest.optional?.capabilities ?? []).map((c) => c.name),
+    ]);
+    const capabilityNames = [...consumed].filter((name) => provided.has(name)).sort();
+    if (capabilityNames.length === 0) continue;
+
+    if (candidate.state === 'PAUSED') {
+      targets.push({ consumerId: candidate.moduleId, capabilityNames, skip: 'paused' });
+      continue;
+    }
+    if (PRE_DEPLOY_STATES.has(candidate.state)) {
+      targets.push({ consumerId: candidate.moduleId, capabilityNames, skip: 'not-deployed' });
+      continue;
+    }
+    targets.push({ consumerId: candidate.moduleId, capabilityNames });
+  }
+
+  return targets.sort((a, b) => a.consumerId.localeCompare(b.consumerId));
+}
+
+/**
+ * Read the plan's inputs out of the DB.
+ *
+ * A module's manifest lives in `modules.manifestData`; a manifest that no
+ * longer parses is skipped rather than fatal, matching `module-remove.ts`'s
+ * dependency scan — a provider deploy must not die on some unrelated module's
+ * bad row.
+ */
+export function loadProviderBackfillPlan(provider: string, db: DbClient): BackfillTarget[] {
+  const provided = db
+    .select({ capabilityName: capabilities.capabilityName })
+    .from(capabilities)
+    .where(eq(capabilities.moduleId, provider))
+    .all()
+    .map((row) => row.capabilityName);
+  if (provided.length === 0) return [];
+
+  const candidates: ConsumerCandidate[] = [];
+  for (const row of db.select().from(modules).all()) {
+    const parsed = ModuleManifestSchema.safeParse(row.manifestData);
+    if (!parsed.success) continue;
+    candidates.push({ moduleId: row.id, manifest: parsed.data, state: row.state });
+  }
+
+  return planProviderBackfill(provider, provided, candidates);
+}
+
+export interface BackfillFailure {
+  consumerId: string;
+  error: string;
+}
+
+export interface ProviderBackfillResult {
+  /** Consumers whose `on_install` was re-run successfully. */
+  rerun: string[];
+  skipped: Array<{ consumerId: string; reason: BackfillSkipReason }>;
+  failures: BackfillFailure[];
+}
+
+/**
+ * Run the plan. Sequential, deterministic, and it CONTINUES PAST A FAILURE:
+ * every consumer is attempted even if an earlier one threw, because stopping
+ * early would leave the remaining consumers unregistered against a provider
+ * that is now live, which is the gap this exists to close.
+ *
+ * A failure never fails the provider's own deploy. The provider deployed fine;
+ * what failed is one consumer's re-registration, and the honest report is a
+ * named consumer with its error and the command that retries it. The caller
+ * surfaces that — silence here would report a clean deploy over a fleet where
+ * some consumers never re-registered.
+ */
+export async function runProviderBackfill(
+  provider: string,
+  plan: BackfillTarget[],
+  db: DbClient,
+  logger: HookLogger,
+  /** Injectable hook runner — tests drive the failure paths through it. */
+  runHook: (consumerId: string) => Promise<RunNamedHookResult> = (consumerId) =>
+    runNamedHook(consumerId, 'on_install', db, createConsoleLogger(consumerId, 'on_install'), {}),
+): Promise<ProviderBackfillResult> {
+  const result: ProviderBackfillResult = { rerun: [], skipped: [], failures: [] };
+
+  for (const target of plan) {
+    if (target.skip) {
+      result.skipped.push({ consumerId: target.consumerId, reason: target.skip });
+      // Reported, not silent. A paused consumer rebinds on its next deploy, so
+      // it is genuinely fine — but the operator should know which modules are
+      // NOT yet talking to the provider that just arrived.
+      if (target.skip === 'paused') {
+        logger.warn(
+          `${target.consumerId} is paused, so it was not re-run against the new '${provider}' — it consumes ${target.capabilityNames.join(', ')} and will rebind on its next deploy.`,
+        );
+      }
+      continue;
+    }
+
+    const hookResult = await runHook(target.consumerId);
+
+    // A module paused BETWEEN the plan and this dispatch. `runNamedHook`
+    // reports that as success, so taking it at face value would log a
+    // re-registration that never happened.
+    if (hookResult.skippedPaused) {
+      result.skipped.push({ consumerId: target.consumerId, reason: 'paused' });
+      logger.warn(
+        `${target.consumerId} was paused while '${provider}' was arriving, so it was not re-run — it will rebind on its next deploy.`,
+      );
+      continue;
+    }
+
+    if (hookResult.success) {
+      // `notDefined` means the consumer declares no `on_install` — there is
+      // nothing to re-run, and the dispatch succeeding is the right answer.
+      if (!hookResult.notDefined) {
+        result.rerun.push(target.consumerId);
+        logger.info(
+          `${target.consumerId} re-registered with '${provider}' (${target.capabilityNames.join(', ')})`,
+        );
+      }
+      continue;
+    }
+
+    const error = hookResult.error ?? 'unknown error';
+    result.failures.push({ consumerId: target.consumerId, error });
+    logger.warn(
+      `${target.consumerId} failed to re-register with '${provider}': ${error}. Run \`celilo module deploy ${target.consumerId}\` to retry.`,
+    );
+  }
+
+  return result;
+}

package/src/templates/generator.test.ts

@@ -13,6 +13,7 @@ import {
   getOutputFilename,
   injectProxmoxDns,
   isTemplateFile,
+  omitUntaggedProxmoxVlan,
   readTemplateFiles,
   storageFromTfState,
   targetNodeFromTfState,
@@ -770,6 +771,40 @@ resource "proxmox_lxc" "container" {
       );
     });
   });
+
+  describe('omitUntaggedProxmoxVlan', () => {
+    const LXC = [
+      'resource "proxmox_lxc" "dns" {',
+      '  target_node = "$self:target_node"',
+      '  network {',
+      '    bridge = "$self:bridge"',
+      '    tag = $self:vlan',
+      '    ip = "$self:target_ip"',
+      '  }',
+      '}',
+    ].join('\n');
+
+    test('omits the optional VLAN tag for an untagged zone', () => {
+      const out = omitUntaggedProxmoxVlan(LXC, false);
+      expect(out).not.toContain('$self:vlan');
+      expect(out).toContain('    bridge = "$self:bridge"');
+      expect(out).toContain('    ip = "$self:target_ip"');
+    });
+
+    test('retains the VLAN tag when the zone has a VLAN ID', () => {
+      expect(omitUntaggedProxmoxVlan(LXC, true)).toBe(LXC);
+    });
+
+    test('preserves literal and non-self VLAN tag expressions', () => {
+      const authored = ['tag = 30', 'tag = var.vlan', 'tag = $system:network.dmz.vlan'].join('\n');
+      expect(omitUntaggedProxmoxVlan(authored, false)).toBe(authored);
+    });
+
+    test('removes an indented tag line with a trailing comment', () => {
+      const content = '    tag = $self:vlan # optional VLAN\r\n    ip = "dhcp"\r\n';
+      expect(omitUntaggedProxmoxVlan(content, false)).toBe('    ip = "dhcp"\r\n');
+    });
+  });
 });
 
 describe("targetNodeFromTfState (ISS-0090 — terraform state is celilo's placement record)", () => {

package/src/templates/generator.ts

@@ -219,6 +219,31 @@ export function injectProxmoxDns(content: string, hasNameserver: boolean): strin
   });
 }
 
+/**
+ * Omit the optional Proxmox network VLAN tag when a zone is explicitly
+ * untagged.
+ *
+ * Celilo represents an untagged zone by leaving `network.<zone>.vlan` unset.
+ * Module templates historically rendered `tag = $self:vlan` unconditionally,
+ * which makes variable resolution fail even though the Proxmox provider treats
+ * an omitted `tag` attribute as the correct untagged configuration. Removing
+ * only that exact framework variable line preserves literal tags and other
+ * tag expressions authored by a module.
+ *
+ * Policy function (Rule 10.1) - pure string transformation, no I/O.
+ *
+ * @param content - Raw terraform template content (pre variable-resolution)
+ * @param hasVlan - Whether `$self:vlan` resolves to a configured VLAN ID
+ * @returns Content with the optional tag line omitted for an untagged zone
+ */
+export function omitUntaggedProxmoxVlan(content: string, hasVlan: boolean): string {
+  if (hasVlan) {
+    return content;
+  }
+
+  return content.replace(/^[ \t]*tag[ \t]*=[ \t]*\$self:vlan[ \t]*(?:#.*)?(?:\r?\n|$)/gm, '');
+}
+
 /**
  * Extract the node a Proxmox guest is deployed on from a parsed terraform state
  * object — an LXC (proxmox_lxc) or a VM (proxmox_vm_qemu). Pure logic (Rule 10),
@@ -1266,7 +1291,10 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
       // every proxmox_lxc resource before resolution (terraform files only).
       const content =
         !isAnsibleTemplate && template.targetPath.endsWith('.tf')
-          ? injectProxmoxDns(template.content, Boolean(context.selfConfig.lxc_nameserver))
+          ? injectProxmoxDns(
+              omitUntaggedProxmoxVlan(template.content, context.selfConfig.vlan !== undefined),
+              Boolean(context.selfConfig.lxc_nameserver),
+            )
           : template.content;
       const result = isAnsibleTemplate
         ? await convertSecretsToJinja(content, context, db)

package/src/variables/context.test.ts

@@ -7,6 +7,7 @@ import {
   capabilities,
   containerServices,
   ipAllocations,
+  machines,
   moduleConfigs,
   moduleInfrastructure,
   moduleSystems,
@@ -193,6 +194,68 @@ describe('Variable Context', () => {
   });
 
   describe('buildResolutionContext', () => {
+    test('records a local machine by its interface identity instead of its transport sentinel', async () => {
+      db.insert(modules)
+        .values({
+          id: 'celilo-mgmt',
+          name: 'Celilo Management',
+          version: '1.0.0',
+          sourcePath: '/test/celilo-mgmt',
+          manifestData: {
+            id: 'celilo-mgmt',
+            name: 'Celilo Management',
+            version: '1.0.0',
+            requires: { system: { zone: 'internal' } },
+          },
+        })
+        .run();
+      db.insert(moduleConfigs)
+        .values({
+          moduleId: 'celilo-mgmt',
+          key: 'hostname',
+          value: 'celilo-mgr',
+          valueJson: '"celilo-mgr"',
+        })
+        .run();
+      db.insert(machines)
+        .values({
+          id: 'local-manager',
+          hostname: 'celilo-mgr',
+          ipAddress: '127.0.0.1',
+          sshUser: 'jem',
+          sshKeyEncrypted: JSON.stringify({ encryptedValue: '', iv: '', authTag: '' }),
+          hardware: { cpu_cores: 4, memory_mb: 8192, disk_gb: 64 },
+          zone: 'internal',
+          earmarkedModule: 'celilo-mgmt',
+          interfaces: [
+            { name: 'ens18', ipAddress: '10.77.20.32', zone: 'internal' },
+            { name: 'wlan0', ipAddress: '192.168.0.32', zone: 'upstream' },
+          ],
+        })
+        .run();
+      db.insert(moduleInfrastructure)
+        .values({
+          id: 'infra-celilo-mgmt',
+          moduleId: 'celilo-mgmt',
+          infrastructureType: 'machine',
+          machineId: 'local-manager',
+        })
+        .run();
+
+      await buildResolutionContext('celilo-mgmt', db);
+
+      const system = db
+        .select()
+        .from(moduleSystems)
+        .where(eq(moduleSystems.moduleId, 'celilo-mgmt'))
+        .get();
+      expect(system).toMatchObject({
+        hostname: 'celilo-mgr',
+        ipv4Address: '10.77.20.32',
+        zone: 'internal',
+      });
+    });
+
     test('should build context with module configs', async () => {
       // Insert module first (for foreign key)
       db.$client.run(

package/src/variables/context.ts

@@ -19,6 +19,7 @@ import { allocateResources, getAllocation } from '../ipam/allocator';
 import { type ModuleManifest, getDeclaredSystems, getSingularSystemSpec } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resolveMachineIdentityAddress } from '../services/deployed-systems';
 import { upsertModuleConfig } from '../services/module-config';
 import { resolveComputedFields } from './computed/evaluate';
 import { containsComputedMarker } from './computed/marker';
@@ -419,10 +420,17 @@ async function assembleResolutionContext(
             `Machine '${infraSelection.machineId}' for module '${moduleId}' has no ipAddress`,
           );
         }
+        const deployedZone = machineRow.zone ?? zone;
+        const machineIdentity = resolveMachineIdentityAddress(machineRow, deployedZone);
+        if (!machineIdentity) {
+          throw new Error(
+            `Machine '${infraSelection.machineId}' for module '${moduleId}' has no non-loopback interface in zone '${deployedZone}'`,
+          );
+        }
         upsertDeployedSystem(db, moduleId, {
           name: decl.name,
           hostname,
-          ipv4Address: machineRow.ipAddress,
+          ipv4Address: machineIdentity,
           // The machine's own zone, matching recordDeployedSystemForModule and
           // backfillModuleSystems. This is the THIRD place that decides a
           // deployed system's zone, and it ran last — so while the other two
@@ -430,7 +438,7 @@ async function assembleResolutionContext(
           // manifest's, and the control plane stayed recorded as `internal`.
           // `requires.system.zone` is the minimum used to SELECT a host; the
           // machine we selected is where the system actually is.
-          zone: machineRow.zone ?? zone,
+          zone: deployedZone,
           infraType: 'machine',
           machineId: infraSelection.machineId,
         });