@celilo/cli 2.1.0 → 2.2.1

package/src/services/module-deploy.ts

@@ -4,6 +4,7 @@
  * Coordinates full module deployment workflow across all phases
  */
 
+import { rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ProgressDisplay } from '@celilo/cli-display';
 import { and, eq } from 'drizzle-orm';
@@ -11,9 +12,10 @@ import { generateInventory } from '../ansible/inventory';
 import { FuelGauge } from '../cli/fuel-gauge';
 import { log, setActiveDisplay } from '../cli/prompts';
 import type { DbClient } from '../db/client';
-import { capabilities, machines, modules } from '../db/schema';
+import { capabilities, machines, modules, systemConfig } from '../db/schema';
 import { loadCapabilityFunctions } from '../hooks/capability-loader';
 import { invokeHook } from '../hooks/executor';
+import { createHookStores } from '../hooks/hook-store';
 import { createGaugeLogger } from '../hooks/logger';
 import { describeArtifacts } from '../hooks/types';
 import type { HookDefinition, HookLogger, HookResult } from '../hooks/types';
@@ -22,6 +24,7 @@ import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import { buildResolutionContext } from '../variables/context';
 import { maybeRunAspectForTrigger } from './aspect-runner';
+import { askConfirm } from './bus-interview';
 import {
   autoDeriveMachineConfig,
   findEnsureOnProvider,
@@ -40,6 +43,7 @@ import { CONTROL_PLANE_MODULE_ID } from './deployed-systems';
 import { getModuleSystems } from './deployed-systems';
 import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
+import { InterviewAbandonedError, InterviewUnansweredError } from './interview-errors';
 import { findMachineForModule } from './machine-pool';
 import { ensureRequiredNetworks } from './network-ensure';
 import {
@@ -101,6 +105,17 @@ export interface DeployOptions {
    * this mode — that requires a real hook run.
    */
   stopAfterInterview?: boolean;
+  /**
+   * D4 (control-plane-stops-building-modules): retain the generated project
+   * after a successful deploy instead of deleting it. The tree is ephemeral
+   * by design — rendered for this deploy from the signed payload plus live
+   * config, used, then removed — because a persisted generated tree cannot be
+   * validated (only its verbatim role assets have a meaningful digest, the
+   * rest is rendered and SUPPOSED to differ), it holds rendered secrets, and
+   * it is what the next deploy would ship. This flag keeps it for deliberate
+   * inspection. It is always kept when the deploy fails.
+   */
+  keepGeneratedProject?: boolean;
 }
 
 /**
@@ -365,6 +380,26 @@ export async function deployModule(
   closeDeployWindows(db, moduleId, new Date());
 
   if (result.success) {
+    // D4 (control-plane-stops-building-modules): the generated project is
+    // ephemeral. It was rendered for THIS deploy from the signed payload plus
+    // live config; a persisted copy is a tree nothing can validate, it holds
+    // rendered secrets, and it is what a later deploy would ship. Now that
+    // the deploy that needed it is done — ansible, hooks, DNS backfill and
+    // aspects all ran inside the impl — it goes. Kept on failure (the impl's
+    // early returns) and under --keep.
+    if (!options.keepGeneratedProject) {
+      const deployed = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+      if (deployed) {
+        const generatedPath = `${deployed.sourcePath}/generated`;
+        try {
+          rmSync(generatedPath, { recursive: true, force: true });
+          log.info(`Removed generated/ for '${moduleId}' (ephemeral by design; --keep retains it)`);
+        } catch (cleanupError) {
+          const msg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+          log.warn(`Failed to remove generated/ for '${moduleId}': ${msg}`);
+        }
+      }
+    }
     // A module that declares a suggested interval starts being watched on its
     // first successful deploy — watching is the default, not a thing to
     // remember.
@@ -388,6 +423,154 @@ export async function deployModule(
   return result;
 }
 
+/**
+ * Headless bound for the repoint confirm. A staged responder replies in
+ * milliseconds; this exists so an attached-but-unstaged responder produces a
+ * defined skip instead of hanging until the suite budget kills the deploy
+ * (module-orchestrator-primitives design.md D5, "never a hang"). On a TTY
+ * there is no bound: the operator IS the responder and may take minutes.
+ */
+const DNS_REPOINT_HEADLESS_TIMEOUT_MS = 60_000;
+
+/**
+ * The deploy-time DNS repoint for a `dns_internal` provider
+ * (module-orchestrator-primitives slice 3, design D5). celilo owns the whole
+ * operation because every input is already celilo's: the resolver address is
+ * the system celilo just placed, and the prior primary/fallback are celilo's
+ * own rows. knot's on_install used to do this through the CLI, one key at a
+ * time, under a catch that reported success over a repoint that never
+ * happened.
+ *
+ * D5 is a recorded DELIBERATE EXCEPTION to the framework-does-not-infer-intent
+ * rule. What makes it acceptable is the interview: the deploy ASKS before it
+ * touches the fleet resolver, and a declined repoint is an operator decision,
+ * not an error. Do not cite this as precedent (design.md D5, "So do not cite
+ * this as precedent").
+ */
+export interface DnsRepointPlan {
+  serverIp: string;
+  priorPrimary: string | undefined;
+  existingFallback: string | undefined;
+  /** Merged dns.fallback when the repoint demotes the prior primary; undefined leaves the key untouched. */
+  newFallback: string | undefined;
+  /** False when dns.primary already names this resolver: the deploy asks nothing. */
+  needsRepoint: boolean;
+}
+
+/**
+ * Pure half of the repoint. The demote keeps an existing fallback (D5's
+ * secondary observation: knot's one-key-at-a-time hook overwrote it, dropping
+ * e.g. 8.8.8.8 from the fleet's resolver list).
+ */
+export function planDnsRepoint(args: {
+  serverIp: string;
+  priorPrimary: string | undefined;
+  existingFallback: string | undefined;
+}): DnsRepointPlan {
+  const { serverIp, priorPrimary, existingFallback } = args;
+  if (priorPrimary === serverIp) {
+    return {
+      serverIp,
+      priorPrimary,
+      existingFallback,
+      newFallback: undefined,
+      needsRepoint: false,
+    };
+  }
+  const newFallback = priorPrimary ? mergeFallback(existingFallback, priorPrimary) : undefined;
+  return { serverIp, priorPrimary, existingFallback, newFallback, needsRepoint: true };
+}
+
+/** Comma-separated, demoted primary first, deduped (public-dns-probe.ts parses commas). */
+function mergeFallback(existing: string | undefined, demoted: string): string {
+  const entries = [demoted];
+  for (const part of (existing ?? '').split(',')) {
+    const ip = part.trim();
+    if (ip && !entries.includes(ip)) entries.push(ip);
+  }
+  return entries.join(',');
+}
+
+function readSystemConfigValue(db: DbClient, key: string): string | undefined {
+  const row = db.select().from(systemConfig).where(eq(systemConfig.key, key)).get();
+  return row?.value && row.value.length > 0 ? row.value : undefined;
+}
+
+function writeSystemConfigValue(db: DbClient, key: string, value: string): void {
+  db.insert(systemConfig)
+    .values({ key, value })
+    .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+    .run();
+}
+
+/**
+ * Ask, then perform (or skip) the repoint for a just-deployed `dns_internal`
+ * provider. Exported for tests; `deployModuleImpl` calls this after the DNS
+ * backfill when the deployed module provides `dns_internal`.
+ */
+export async function repointDnsPrimaryForProvider(
+  moduleId: string,
+  db: DbClient,
+  ask: typeof askConfirm = askConfirm,
+): Promise<void> {
+  const serverIp = getModuleSystems(moduleId, db)[0]?.ipv4_address;
+  if (!serverIp) {
+    log.warn(
+      `dns_internal provider '${moduleId}' has no deployed system — skipping dns.primary repoint`,
+    );
+    return;
+  }
+  const plan = planDnsRepoint({
+    serverIp,
+    priorPrimary: readSystemConfigValue(db, 'dns.primary'),
+    existingFallback: readSystemConfigValue(db, 'dns.fallback'),
+  });
+  if (!plan.needsRepoint) {
+    log.info(`dns.primary already points at ${serverIp} — no repoint needed`);
+    return;
+  }
+
+  const demoteNote = plan.newFallback
+    ? ` The old primary ${plan.priorPrimary} moves to dns.fallback (${plan.newFallback}).`
+    : '';
+  const opts = {
+    scope: `deploy:${moduleId}`,
+    key: 'repoint_dns_primary',
+    message: `Deploying '${moduleId}' made it the fleet's internal DNS resolver. Point dns.primary at ${serverIp}?${demoteNote}`,
+    defaultValue: false,
+  };
+  // Called DIRECTLY, not inside withInterviewSession: deployModuleImpl already
+  // opened the terminal responder above and closes it in its finally. A second
+  // responder instance would race the first on stdin (design.md D5).
+  let confirmed: boolean;
+  try {
+    confirmed = await ask(
+      process.stdin.isTTY ? opts : { ...opts, timeoutMs: DNS_REPOINT_HEADLESS_TIMEOUT_MS },
+    );
+  } catch (error) {
+    if (error instanceof InterviewUnansweredError || error instanceof InterviewAbandonedError) {
+      log.warn(
+        `dns.primary repoint skipped — nobody answered the confirm (${opts.scope}:${opts.key}). Stage the answer (celilo events respond --values) or set dns.primary manually later.`,
+      );
+      return;
+    }
+    throw error;
+  }
+
+  if (!confirmed) {
+    log.info('dns.primary repoint declined — fleet resolver left unchanged');
+    return;
+  }
+
+  writeSystemConfigValue(db, 'dns.primary', serverIp);
+  if (plan.newFallback !== undefined) {
+    writeSystemConfigValue(db, 'dns.fallback', plan.newFallback);
+  }
+  log.success(
+    `dns.primary repointed at internal resolver ${serverIp}${plan.newFallback ? ` (dns.fallback: ${plan.newFallback})` : ''}`,
+  );
+}
+
 async function deployModuleImpl(
   moduleId: string,
   db: DbClient,
@@ -641,26 +824,10 @@ async function deployModuleImpl(
 
     log.success('Templates generated');
 
-    // Pre-flight: refuse before contacting any system if the generated project
-    // does not match the module tree it was generated from (D6).
-    //
-    // This is the check that would have turned celilo#925 from a silent success
-    // into a refusal at the point of the fault. A verbatim role asset that
-    // failed to refresh is invisible downstream: `cp` reports no error, Ansible
-    // copies the stale bytes and reports `ok`, unchanged, and the module's
-    // version advances past code that never shipped. Local, milliseconds, no
-    // SSH. It deliberately does NOT verify after the deploy — Ansible's
-    // `changed` is truthful about what Ansible did, and the lie is upstream of
-    // Ansible.
-    const { refuseIfGeneratedIsStale } = await import('../module/packaging/generated-plane');
-    const staleGenerated = await refuseIfGeneratedIsStale(
-      moduleId,
-      module.sourcePath,
-      generatedPath,
-    );
-    if (staleGenerated) {
-      return { success: false, error: staleGenerated, phases };
-    }
+    // The generated-tree staleness pre-flight (D6 of module-integrity-rigor)
+    // retired here (D5 of control-plane-stops-building-modules): the tree is
+    // rendered for THIS deploy and deleted when it succeeds, so nothing
+    // persists that could be stale relative to what ships.
 
     // Run validate_config hook if defined (e.g., credential validation via Playwright)
     if (manifest.hooks?.validate_config) {
@@ -724,6 +891,7 @@ async function deployModuleImpl(
             requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(moduleId, db),
             remoteAccess: remoteAccessPolicy(moduleId, db),
+            hookStores: () => createHookStores(db, moduleId),
           },
         );
 
@@ -863,6 +1031,7 @@ async function deployModuleImpl(
                 requiredCapabilities: (manifest.requires?.capabilities ?? []).map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
                 remoteAccess: remoteAccessPolicy(moduleId, db),
+                hookStores: () => createHookStores(db, moduleId),
               },
             };
           },
@@ -1165,6 +1334,7 @@ async function deployModuleImpl(
             requiredCapabilities: providerManifest.requires.capabilities.map((c) => c.name),
             systems: getModuleSystems(capRecord.moduleId, db),
             remoteAccess: remoteAccessPolicy(capRecord.moduleId, db),
+            hookStores: () => createHookStores(db, capRecord.moduleId),
           },
         );
 
@@ -1483,6 +1653,7 @@ async function deployModuleImpl(
                 requiredCapabilities: manifest.requires.capabilities.map((c) => c.name),
                 systems: getModuleSystems(moduleId, db),
                 remoteAccess: remoteAccessPolicy(moduleId, db),
+                hookStores: () => createHookStores(db, moduleId),
               },
             };
           },
@@ -1608,6 +1779,13 @@ async function deployModuleImpl(
             `DNS backfill failed for '${moduleId}': ${msg}. Some internal DNS records may need manual setup.`,
           );
         }
+
+        // The dns_internal handoff (module-orchestrator-primitives slice 3,
+        // design D5): celilo repoints dns.primary at the resolver it just
+        // deployed, gated on an interview. knot's on_install no longer does
+        // this. Runs after the backfill so a failed deploy never repoints the
+        // fleet at a resolver that never came up.
+        await repointDnsPrimaryForProvider(moduleId, db);
       }
 
       // Announce each deployed system on the bus (D5/D6) — one

package/src/services/module-operations.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   InFlightError,
   OPERATIONS_SWEEP_PATTERN,
@@ -30,7 +31,7 @@ describe('module-operations', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-subscriptions.test.ts

@@ -10,6 +10,7 @@ import { ModuleManifestSchema } from '../manifest/schema';
 import { ModuleSubscriptionSchema } from '../manifest/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt as migrateDbFile } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   registerModuleSubscriptions,
   resolveSubscription,
@@ -341,7 +342,7 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   });
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/module-validator/git-hygiene.test.ts

@@ -1,8 +1,9 @@
 import { describe, expect, test } from 'bun:test';
 import { execSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
+import { classifyModulePath } from '../../module/packaging/package-rules';
 import { checkGitHygiene, checkModuleStale } from './git-hygiene';
 
 interface TempRepo {
@@ -18,8 +19,19 @@ interface TempRepo {
  */
 function makeTempRepo(): TempRepo {
   const dir = mkdtempSync(join(tmpdir(), 'celilo-git-hygiene-'));
+  // Bound every git child. A git call that hangs used to run until bun's
+  // per-test timeout killed it, and bun's dangling-process kill left the
+  // WHOLE run parked (reproduced for celilo#1282; the park itself is
+  // celilo#1246). Erroring the test instead keeps the failure visible and
+  // the run exitable. 30s per command stays under the 60s per-test ceiling
+  // this suite runs with.
   const exec = (cmd: string): string =>
-    execSync(cmd, { cwd: dir, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+    execSync(cmd, {
+      cwd: dir,
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 30_000,
+    });
   exec('git init -q');
   exec('git config user.email "test@example.com"');
   exec('git config user.name "Test"');
@@ -88,6 +100,113 @@ describe('checkModuleStale', () => {
   });
 });
 
+describe('staleness reach vs the packager (celilo#1270)', () => {
+  // Paths planted to span the classifications classifyModulePath produces.
+  // The expected staleness outcome is NOT hand-written per path: each test
+  // asks classifyModulePath what the packager does with the path and holds
+  // the staleness gate to the same answer.
+  const planted = [
+    'e2e/split-horizon-views.test.ts',
+    'e2e/fixtures/cases.json',
+    'scripts/install.sh',
+    'scripts/tsconfig.json',
+    'ansible/playbook.yml',
+    'terraform/main.tf',
+    'schema/tables.sql',
+    'hooks/run.test.ts',
+    'generated/report.json',
+    'state/last-run.json',
+  ];
+
+  /** Repo with only manifest.yml committed; returns `commit(rel)` helper. */
+  function repoWithManifest() {
+    const repo = makeTempRepo();
+    writeFileSync(join(repo.dir, 'manifest.yml'), 'id: x\nversion: 1.0.0\n');
+    repo.exec('git add manifest.yml && git commit -q -m manifest');
+    const commit = (rel: string) => {
+      const abs = join(repo.dir, rel);
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, 'planted\n');
+      repo.exec(`git add ${rel} && git commit -q -m ${JSON.stringify(rel)}`);
+    };
+    return { repo, commit };
+  }
+
+  test(
+    'a commit touching only e2e/ does not mark the manifest stale',
+    () => {
+      const { repo, commit } = repoWithManifest();
+      try {
+        commit('e2e/split-horizon-views.test.ts');
+        expect(checkModuleStale(repo.dir)).toBeNull();
+      } finally {
+        repo.cleanup();
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'a commit touching scripts/, ansible/, terraform/ or schema/ still fires',
+    () => {
+      for (const rel of [
+        'scripts/install.sh',
+        'ansible/playbook.yml',
+        'terraform/main.tf',
+        'schema/tables.sql',
+      ]) {
+        const { repo, commit } = repoWithManifest();
+        try {
+          commit(rel);
+          expect(classifyModulePath(rel)).toBe('package');
+          expect(checkModuleStale(repo.dir)).not.toBeNull();
+        } finally {
+          repo.cleanup();
+        }
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'reach parity: the gate fires exactly for paths the packager ships',
+    async () => {
+      for (const rel of planted) {
+        const { repo, commit } = repoWithManifest();
+        try {
+          commit(rel);
+          const stale = checkModuleStale(repo.dir);
+          if (classifyModulePath(rel) === 'package') {
+            expect(stale).not.toBeNull();
+          } else {
+            expect(stale).toBeNull();
+          }
+        } finally {
+          repo.cleanup();
+        }
+      }
+    },
+    { timeout: 30_000 },
+  );
+
+  test(
+    'non-shipped commits between manifest and a shipped change stay quiet until shipped bytes move',
+    () => {
+      const { repo, commit } = repoWithManifest();
+      try {
+        commit('e2e/split-horizon-views.test.ts');
+        commit('scripts/tsconfig.json');
+        expect(checkModuleStale(repo.dir)).toBeNull();
+        commit('scripts/install.sh');
+        expect(checkModuleStale(repo.dir)).not.toBeNull();
+      } finally {
+        repo.cleanup();
+      }
+    },
+    { timeout: 30_000 },
+  );
+});
+
 describe('checkGitHygiene', () => {
   test('all ok on a fresh, clean repo with manifest as latest commit', () => {
     const repo = makeTempRepo();

package/src/services/module-validator/git-hygiene.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
+import { classifyModulePath } from '../../module/packaging/package-rules';
 import { collectGitInfo, makeRealGitRunner } from '../../module/packaging/release-metadata';
 import type { Check } from './types';
 
@@ -19,10 +20,14 @@ export interface StalenessIssue {
  * anywhere should still talk to lunacycle's git history).
  */
 function lastCommitTouching(cwd: string, pathspec: string[]): string | null {
+  // timeout: a hung git degrades to the "can't determine — skip" path (status
+  // null) instead of hanging `module check` forever. 30s is enormous against
+  // the milliseconds a bounded `git log -1` takes on any real repo.
   const r = spawnSync('git', ['log', '-1', '--format=%H', '--', ...pathspec], {
     cwd,
     stdio: ['ignore', 'pipe', 'ignore'],
     encoding: 'utf-8',
+    timeout: 30_000,
   });
   if (r.status !== 0) return null;
   const sha = r.stdout.trim();
@@ -33,17 +38,90 @@ function isAncestor(cwd: string, maybeAncestor: string, descendant: string): boo
   const r = spawnSync('git', ['merge-base', '--is-ancestor', maybeAncestor, descendant], {
     cwd,
     stdio: 'ignore',
+    timeout: 30_000,
   });
   return r.status === 0;
 }
 
+/**
+ * One commit from `git log --name-only`: its SHA and the repo-root-relative
+ * paths it changed. A merge commit carries an empty file list (git log omits
+ * diffs for merges), so it never qualifies as a src commit — which is right,
+ * a merge changes no authored byte of its own.
+ */
+interface CommitWithPaths {
+  sha: string;
+  paths: string[];
+}
+
+/**
+ * The commits touching `pathspec`, newest first, with the repo-root-relative
+ * paths each one changed. `git log --name-only` prints repo-root-relative
+ * paths even when cwd is a subdirectory (measured: it does not honor cwd for
+ * output), so the caller strips the prefix itself via `show-prefix`.
+ */
+function listCommitsTouching(cwd: string, pathspec: string): CommitWithPaths[] {
+  const r = spawnSync(
+    'git',
+    ['-c', 'core.quotePath=false', 'log', '--format=%H', '--name-only', '--', pathspec],
+    { cwd, stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' },
+  );
+  if (r.status !== 0) return [];
+  const commits: CommitWithPaths[] = [];
+  let current: CommitWithPaths | null = null;
+  for (const line of (r.stdout ?? '').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (/^[0-9a-f]{40}$/.test(trimmed)) {
+      current = { sha: trimmed, paths: [] };
+      commits.push(current);
+    } else if (current) {
+      current.paths.push(trimmed);
+    }
+  }
+  return commits;
+}
+
+/**
+ * SHA of the last commit that touched SHIPPED module source, or null when no
+ * commit qualifies (no history, or only non-shipped paths ever committed).
+ *
+ * The staleness scan's reach is the PACKAGER's rule, not a second list beside
+ * it (celilo#1270). A path counts as source exactly when `classifyModulePath`
+ * calls it `package` — the same answer that decides whether the path lands in
+ * the .netapp. So a commit touching only `e2e/**`, `*.test.ts`, or
+ * `tsconfig.json` changes no installed byte and must not read as drift.
+ *
+ * Excluding manifest.yml from the "src" scan is the gate's own semantics, not
+ * packaging: we want to know if anything else shipped past it. node_modules,
+ * dist, and other build outputs are gitignored and so never appear here.
+ */
+function lastShippedSourceCommit(moduleDir: string): string | null {
+  const prefixR = spawnSync('git', ['rev-parse', '--show-prefix'], {
+    cwd: moduleDir,
+    stdio: ['ignore', 'pipe', 'ignore'],
+    encoding: 'utf-8',
+  });
+  if (prefixR.status !== 0) return null;
+  const repoPrefix = (prefixR.stdout ?? '').trim();
+  for (const commit of listCommitsTouching(moduleDir, moduleDir)) {
+    for (const p of commit.paths) {
+      if (repoPrefix && !p.startsWith(repoPrefix)) continue;
+      const rel = repoPrefix ? p.slice(repoPrefix.length) : p;
+      if (rel === 'manifest.yml') continue;
+      if (classifyModulePath(rel) === 'package') return commit.sha;
+    }
+  }
+  return null;
+}
+
 /**
  * Detect "I edited module src but forgot to bump (or touch) manifest.yml."
  *
- * Returns null when the manifest is the most recently-touched file in the
- * dir (or when neither side has any commit history — e.g. brand-new module
- * not yet committed). Returns a StalenessIssue when src has commits AFTER
- * the last manifest.yml change — the operator must bump the manifest
+ * Returns null when the manifest is the most recently-touched shipped file in
+ * the dir (or when neither side has any commit history — e.g. brand-new module
+ * not yet committed). Returns a StalenessIssue when shipped src has commits
+ * AFTER the last manifest.yml change — the operator must bump the manifest
  * (semver change → reset +N to 1) or just touch it (release-only change →
  * auto-bump +N), then re-publish.
  *
@@ -54,16 +132,7 @@ function isAncestor(cwd: string, maybeAncestor: string, descendant: string): boo
 export function checkModuleStale(moduleDir: string): StalenessIssue | null {
   const manifestPath = join(moduleDir, 'manifest.yml');
   const lastManifest = lastCommitTouching(moduleDir, [manifestPath]);
-  // Excluding manifest.yml from the "src" pathspec is the whole point — we
-  // want to know if anything ELSE in the dir moved past it. node_modules
-  // and common build outputs are gitignored already, but be explicit
-  // defensively.
-  const lastSrc = lastCommitTouching(moduleDir, [
-    moduleDir,
-    `:(exclude)${manifestPath}`,
-    `:(exclude)${moduleDir}/node_modules`,
-    `:(exclude)${moduleDir}/dist`,
-  ]);
+  const lastSrc = lastShippedSourceCommit(moduleDir);
   if (!lastManifest || !lastSrc) return null;
   if (lastSrc === lastManifest) return null;
   if (!isAncestor(moduleDir, lastManifest, lastSrc)) return null;

package/src/services/port-forwards.test.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { portForwards } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { deleteClaimedRows } from './capability-table-rows';
 import { buildPortForwardStore } from './port-forwards';
 
@@ -27,7 +28,7 @@ describe('port-forward store', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/programmatic-responder.aspect.test.ts

@@ -17,6 +17,7 @@ import { join } from 'node:path';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { type AspectRequiredPayload, EVENT_TYPES } from './bus-interview';
 import { startProgrammaticResponder } from './programmatic-responder';
 
@@ -72,7 +73,7 @@ describe('programmatic responder — aspect.required consent (#262)', () => {
   afterEach(() => {
     closeDb();
     rmSync(dir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   it('approves (consented=true) when the policy approves the module', async () => {

package/src/services/proxmox-reconcile.test.ts

@@ -27,6 +27,7 @@ import {
   modules,
 } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { upsertModuleConfig } from './module-config';
 import { executeProxmoxReconcile, planProxmoxReconcile } from './proxmox-reconcile';
 
@@ -153,7 +154,7 @@ describe('proxmox-reconcile', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {