@celilo/cli 2.2.0 → 2.2.1

package/src/policy/no-swallowed-refusal.test.ts

@@ -226,14 +226,12 @@ describe('recurrence gate: a hook does not swallow a refused framework call', ()
     );
     const sites = violations.map((v) => v.file.replace(`${repoRoot()}/`, '')).sort();
     // Pinned to the exact sites from e2e-suite-recovery task 4.2, as measured
-    // on 2026-09-07 at on_backup.ts:52 and health-check.ts:73 (a third,
-    // on-install.ts:69, converted by ce-pvii the same day). A converted site
-    // drops out and the debt entry must go; a NEW site appearing here is the
-    // next instance this scan exists to stop.
-    expect(sites).toEqual([
-      'modules/celilo-mgmt/scripts/on_backup.ts',
-      'modules/wireguard/scripts/health-check.ts',
-    ]);
+    // on 2026-09-07 at on_backup.ts:52 (a third, on-install.ts:69, converted
+    // by ce-pvii the same day, and wireguard's health-check.ts converted by
+    // 01575380 the same evening). A converted site drops out and the debt
+    // entry must go; a NEW site appearing here is the next instance this scan
+    // exists to stop.
+    expect(sites).toEqual(['modules/celilo-mgmt/scripts/on_backup.ts']);
   });
 });
 
@@ -259,7 +257,8 @@ describe('recurrence gate: the swallow debt list is honest', () => {
 
   test('the debt list is non-trivial (the guard actually reached the entries)', () => {
     // The list held three entries until ce-pvii converted the on-install.ts
-    // entry (2026-09-07); two remain, so the guard still proves engagement.
-    expect(SWALLOWED_REFUSAL_DEBT.length).toBeGreaterThan(1);
+    // entry and 01575380 converted wireguard's health-check (both
+    // 2026-09-07); one remains, so the guard still proves engagement.
+    expect(SWALLOWED_REFUSAL_DEBT.length).toBeGreaterThan(0);
   });
 });

package/src/services/alerting/ack.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { acknowledgeAlert, findLiveAlertByKey, resolveAlertManually, silenceAlert } from './ack';
 import { moduleCheckAlertKey } from './keys';
 import { createPerson, createRoute } from './people';
@@ -79,7 +80,7 @@ describe('ack / silence / resolve', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/cadence-migration.test.ts

@@ -16,6 +16,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../../db/client';
 import { runMigrations } from '../../db/migrate';
 import { modules, monitors } from '../../db/schema';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { getModuleConfigValue, upsertModuleConfig } from '../module-config';
 import { migrateMonitorCadences } from './cadence-migration';
 import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, loadModuleHealthCadences } from './health-cadence';
@@ -66,7 +67,7 @@ describe('migrateMonitorCadences', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 
@@ -132,7 +133,7 @@ describe("a module_hook row's stored cadence is not consulted", () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/alerting/coverage-source.test.ts

@@ -20,6 +20,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { CONTROL_PLANE_MODULE_ID } from '../deployed-systems';
 import { loadModuleCoverage } from './coverage-source';
 import { healthCoverageFailingKeys } from './health-coverage';
@@ -37,7 +38,7 @@ describe('health coverage and the control plane', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/deferral.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { moduleCheckAlertKey } from './keys';
 import { deliverDeferred } from './notifier';
 import { createPerson, createRoute } from './people';
@@ -80,7 +81,7 @@ describe('quiet-hours deferral', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/delivery-loop.test.ts

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Route, modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { EscalationStep, RouteForEscalation } from './escalation';
 import { interpretInbound } from './inbound';
 import {
@@ -249,7 +250,7 @@ describe('delivery loop against the signal-cli simulator', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/deploy-hooks.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   closeDeployWindows,
   ensureMonitorOnDeploy,
@@ -34,7 +35,7 @@ describe('deploy hooks', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/inbound-poller.test.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Route, alerts, modules, monitors, notificationDeliveries } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type InboundPollDeps,
   type TransportReadRecord,
@@ -105,7 +106,7 @@ describe('pollInbound', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/inbound.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { type NotificationDelivery, modules, people, routes } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { interpretInbound, parseInbound } from './inbound';
 import { mintDelivery } from './tokens';
 
@@ -107,7 +108,7 @@ describe('interpretInbound', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/notification-responder.test.ts

@@ -6,6 +6,7 @@ import { defineEvents, openBus } from '@celilo/event-bus';
 import type { DbClient } from '../../db/client';
 import { type Route, modules } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type NotificationResponderHandle,
   startNotificationResponder,
@@ -88,7 +89,7 @@ describe('notification responder', () => {
     handle?.stop();
     handle = undefined;
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/run-monitor.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Monitor, alerts, monitorRuns, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { HealthCheckResult } from '../health-runner';
 import { HOOK_JAIL_CHECK, type HookJailState } from './hook-jail';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
@@ -71,7 +72,7 @@ describe('runOneMonitor', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/store.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { alerts, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import { moduleAlertKey, moduleCheckAlertKey } from './keys';
 import type { ReconcileAction } from './reconcile';
 import {
@@ -55,7 +56,7 @@ describe('alert store', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/sweep-runner.test.ts

@@ -6,6 +6,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type Alert, type Monitor, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import type { HealthCheckResult } from '../health-runner';
 import { deleteModuleConfig, upsertModuleConfig } from '../module-config';
 import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, reconcileModuleWatchState } from './health-cadence';
@@ -99,7 +100,7 @@ describe('runSweep', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/alerting/tokens.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../../db/client';
 import { modules, people, routes } from '../../db/schema';
 import { setupTestDatabaseAt } from '../../test-utils/database';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   consumeDelivery,
   deliveriesForAlert,
@@ -75,7 +76,7 @@ describe('delivery records', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-approvals.test.ts

@@ -6,6 +6,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   checkAspectApproval,
   computeAspectScopeHash,
@@ -44,7 +45,7 @@ describe('aspect-approvals', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-reconcile.test.ts

@@ -20,6 +20,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { type ModuleState, modules } from '../db/schema';
 import type { BaseModuleAspect } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   computeAspectScopeHash,
   recordAspectApproval,
@@ -159,7 +160,7 @@ describe('reconcileAspectsForSystems', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -310,7 +311,7 @@ describe('planAspectFanOut onlyHostnames', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -352,7 +353,7 @@ describe('verifyAspectCoverage', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/aspect-runner.test.ts

@@ -20,6 +20,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { BaseModuleAspect, ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   computeAspectScopeHash,
   findAspectApproval,
@@ -109,7 +110,7 @@ describe('aspect-runner', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/audit/module-integrity.test.ts

@@ -82,27 +82,6 @@ describe('auditModuleIntegrity', () => {
     expect(findings[0]?.details).toContain('scripts/new.ts');
   });
 
-  test('a stale generated project is drift, and says a deploy would ship the wrong bytes', () => {
-    const findings = auditModuleIntegrity({
-      results: [
-        {
-          ...clean('wireguard-manager'),
-          success: false,
-          violations: [
-            {
-              type: 'stale-generated',
-              path: 'ansible/roles/vpn/files/bin',
-              message: 'Generated project holds different bytes',
-            },
-          ],
-        },
-      ],
-    });
-    expect(findings.map((f) => f.code)).toEqual(['module_generated_stale']);
-    expect(findings[0]?.severity).toBe('drift');
-    expect(findings[0]?.remediation).toBe('celilo module generate wireguard-manager');
-  });
-
   test('host-plane results carry through with the right severity', () => {
     const findings = auditModuleIntegrity({
       results: [

package/src/services/audit/module-integrity.ts

@@ -58,20 +58,6 @@ export function auditModuleIntegrity(deps: ModuleIntegrityAuditDeps): DriftFindi
       });
     }
 
-    const generated = result.violations.filter((v) => v.type === 'stale-generated');
-    if (generated.length > 0) {
-      findings.push({
-        category: 'module_integrity',
-        severity: 'drift',
-        code: 'module_generated_stale',
-        message: `${result.moduleId}: ${generated.length} generated asset(s) do not match the installed module — a deploy would ship the wrong bytes`,
-        details: generated.map((v) => `  • ${v.path}`).join('\n'),
-        remediation: `celilo module generate ${result.moduleId}`,
-        actionable: true,
-        subject: result.moduleId,
-      });
-    }
-
     // File differences are only meaningful once the baseline is trustworthy.
     // Reporting them under a stale baseline is what made `module verify`
     // unreadable: 72 violations across two healthy modules, nearly all of them

package/src/services/backup-age-agreement.test.ts

@@ -18,6 +18,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { backupStorages, backups, modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { loadBackupAuditInfo } from './audit/backup-source';
 import { findBackupEligibleModules } from './backup-create';
 import { loadBackupHistory } from './backup-metadata';
@@ -79,7 +80,7 @@ describe('backup age: the run path and the audit path read the same column', ()
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/backup-envelope-roundtrip.test.ts

@@ -32,6 +32,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { backups, systemConfig } from '../db/schema';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { decryptFileToFile, encryptFileToFile } from './backup-cipher';
 import { createSystemStateBackup } from './backup-create';
 import { MANIFEST_SCHEMA_VERSION, buildManifest, parseManifest } from './backup-manifest';
@@ -64,7 +65,7 @@ describe('backup envelope round-trip', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/backup-in-flight-refusal.test.ts

@@ -18,6 +18,7 @@ import { join } from 'node:path';
 import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { backups, moduleOperations } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { createModuleBackup, createSystemStateBackup } from './backup-create';
 import { restoreModuleBackup, restoreSystemStateBackup } from './backup-restore';
 import { InFlightError } from './module-operations';
@@ -34,7 +35,7 @@ describe('backup/restore in-flight refusal', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/bus-ensure-flow.test.ts

@@ -27,6 +27,7 @@ import { moduleConfigs, modules, secrets } from '../db/schema';
 import type { Ensure } from '../manifest/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resetTestDbPath } from '../test-utils/db-path';
 import type { EnsureRequiredPayload } from './bus-interview';
 import { interviewForEnsureInputs, writeModuleSecretKey } from './config-interview';
 
@@ -174,7 +175,7 @@ describe('bus-mediated interviewForEnsureInputs', () => {
   afterEach(() => {
     bus.close();
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
   });
 

package/src/services/bus-interview-park.test.ts

@@ -26,6 +26,7 @@ import { type Bus, type BusEvent, defineEvents, openBus } from '@celilo/event-bu
 import { handleModuleUpdate } from '../cli/commands/module-update';
 import { getDb } from '../db/client';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { RESPONDER_PROBE_EVENT } from './responder-probe';
 
 const NO_SCHEMAS = defineEvents({});
@@ -91,7 +92,7 @@ beforeEach(() => {
 afterEach(() => {
   server.stop(true);
   rmSync(dir, { recursive: true, force: true });
-  process.env.CELILO_DB_PATH = undefined;
+  resetTestDbPath();
   process.env.CELILO_ORIGINAL_CWD = undefined;
   process.env.EVENT_BUS_DB = undefined;
 });

package/src/services/bus-secret-flow.test.ts

@@ -21,6 +21,7 @@ import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { type DbClient, getDb } from '../db/client';
 import { modules } from '../db/schema';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { resetTestDbPath } from '../test-utils/db-path';
 import type { SecretRequiredPayload } from './bus-interview';
 import {
   interviewForMissingSecrets,
@@ -154,7 +155,7 @@ describe('bus-mediated interviewForMissingSecrets', () => {
   afterEach(() => {
     bus.close();
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.EVENT_BUS_DB = undefined;
   });
 

package/src/services/capability-table-rows.test.ts

@@ -20,6 +20,7 @@ import { allDeclaredTables } from '@celilo/capabilities';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords, modules, portForwards, trustedSources, webRoutes } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { deleteClaimedRows, planClaimedRowDeletion } from './capability-table-rows';
 
 const FW = '192.168.0.254';
@@ -74,7 +75,7 @@ describe('deleteClaimedRows', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/consumer-cleanup.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import type { DbClient } from '../db/client';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type CleanupTarget,
   type ProviderRow,
@@ -216,7 +217,7 @@ describe('runConsumerCleanup — the paused skip is reported, not silent', () =>
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 
@@ -285,7 +286,7 @@ describe('runConsumerCleanup — dispatch', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });
 

package/src/services/container-service.test.ts

@@ -10,6 +10,7 @@ import { eq } from 'drizzle-orm';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { containerServices } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   addContainerService,
   getContainerService,
@@ -53,7 +54,7 @@ describe('container-service', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_MASTER_KEY_PATH = undefined;
   });
 

package/src/services/control-plane-bootstrap.test.ts

@@ -17,6 +17,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { capabilities, modules, systemConfig } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type ControlPlaneBootstrapOptions,
   bootstrapControlPlane,
@@ -58,7 +59,7 @@ describe('bootstrapControlPlane', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/cross-module-read.test.ts

@@ -15,6 +15,7 @@ import { closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   type CrossModuleIndex,
   applyCrossModuleWriteRoot,
@@ -70,7 +71,7 @@ describe('materializeCrossModuleRoot', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     process.env.CELILO_DATA_DIR = undefined;
     try {
       rmSync(dir, { recursive: true, force: true });

package/src/services/deploy-validation.test.ts

@@ -21,6 +21,7 @@ import { join } from 'node:path';
 import { type DbClient, getDb } from '../db/client';
 import { modules, secrets } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { findMissingSecrets } from './config-interview';
 import { findMissingBuildArtifacts, findMissingRequiredVariables } from './deploy-validation';
 
@@ -89,7 +90,7 @@ describe('findMissingRequiredVariables (deploy path)', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   // The bug we're guarding against: the deploy used to drop type +
@@ -210,7 +211,7 @@ describe('findMissingSecrets (shared)', () => {
 
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
   });
 
   test('accepts loose unknown[] declares (manifest read off disk)', async () => {

package/src/services/dns-internal-records.test.ts

@@ -8,6 +8,7 @@ import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
 import { dnsInternalRecords, modules } from '../db/schema';
 import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   listDnsInternalRecords,
   listViewOverrides,
@@ -42,7 +43,7 @@ describe('dns-internal-records ledger', () => {
   });
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -248,7 +249,7 @@ describe('provider cascade (celilo#1010)', () => {
 
   afterEach(() => {
     db.$client.close();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     rmSync(dir, { recursive: true, force: true });
   });