@celilo/cli 2.2.0 → 2.3.0

package/src/services/health-runner.test.ts

@@ -1,5 +1,14 @@
-import { describe, expect, test } from 'bun:test';
-import { nextModuleState } from './health-runner';
+import { describe, expect, spyOn, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { type DbClient, getDb } from '../db/client';
+import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
+import * as controlPlaneHealth from './control-plane-health';
+import type { HealthCheckItem } from './health-runner';
+import { deriveHealthStatus, nextModuleState, runModuleHealthCheck } from './health-runner';
 
 /**
  * The D15 rule: a scheduled (monitor-driven) health check observes only and
@@ -9,6 +18,34 @@ import { nextModuleState } from './health-runner';
  * throw, it just makes `celilo module list` flicker between INSTALLED and
  * VERIFIED every monitor interval.
  */
+describe('deriveHealthStatus', () => {
+  const item = (status: HealthCheckItem['status'], name = 'probe'): HealthCheckItem => ({
+    name,
+    status,
+    message: 'msg',
+  });
+
+  test('fail dominates everything', () => {
+    expect(deriveHealthStatus([item('pass'), item('fail'), item('warn')])).toBe('unhealthy');
+  });
+
+  test('warn without fail is degraded', () => {
+    expect(deriveHealthStatus([item('pass'), item('warn')])).toBe('degraded');
+  });
+
+  test('measured passes with a skip are healthy — the audit carries the skip', () => {
+    expect(deriveHealthStatus([item('pass'), item('skip')])).toBe('healthy');
+  });
+
+  test('only skips is no-checks — nothing was measured', () => {
+    expect(deriveHealthStatus([item('skip'), item('skip')])).toBe('no-checks');
+  });
+
+  test('empty checks is healthy (the hook ran and reported nothing)', () => {
+    expect(deriveHealthStatus([])).toBe('healthy');
+  });
+});
+
 describe('nextModuleState', () => {
   describe('operator-invoked run (unattended = false)', () => {
     test('passing check verifies an INSTALLED module', () => {
@@ -48,3 +85,51 @@ describe('nextModuleState', () => {
     });
   });
 });
+
+// celilo#1363: a failed upgrade leaves state ERROR with an errorMessage. The
+// recovery path is an attended health check passing, which moves ERROR →
+// VERIFIED. The message must move with the state, or `module list` keeps
+// printing the old `Error:` line beside a healthy row.
+describe('runModuleHealthCheck — clearing a recorded failure (celilo#1363)', () => {
+  test('an attended healthy check clears errorMessage along with the state', async () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'celilo-health-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+
+    try {
+      const db: DbClient = getDb();
+      db.insert(modules)
+        .values({
+          id: 'celilo-mgmt',
+          name: 'Control plane',
+          sourcePath: join(tempDir, 'celilo-mgmt'),
+          version: '1.0.0+5',
+          state: 'ERROR',
+          errorMessage: 'Upgrade to 1.0.0+6 failed to deploy: ssh: connection refused',
+          manifestData: {
+            celilo_contract: '1.0',
+            id: 'celilo-mgmt',
+            name: 'Control plane',
+            version: '1.0.0',
+          },
+        })
+        .run();
+
+      const checks: HealthCheckItem[] = [{ name: 'probe', status: 'pass', message: 'ok' }];
+      const spy = spyOn(controlPlaneHealth, 'controlPlaneHealthChecks').mockResolvedValue(checks);
+      try {
+        const result = await runModuleHealthCheck('celilo-mgmt', db, {});
+        expect(result.status).toBe('healthy');
+      } finally {
+        spy.mockRestore();
+      }
+
+      const row = db.select().from(modules).where(eq(modules.id, 'celilo-mgmt')).get();
+      if (!row) throw new Error('row missing after health check');
+      expect(row.state).toBe('VERIFIED');
+      expect(row.errorMessage).toBeNull();
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+      resetTestDbPath();
+    }
+  });
+});

package/src/services/health-runner.ts

@@ -24,7 +24,14 @@ import { remoteAccessPolicy } from './remote-access';
 
 export interface HealthCheckItem {
   name: string;
-  status: 'pass' | 'warn' | 'fail';
+  /**
+   * `skip` — the check could not perform its real probe (a credential is
+   * not provisioned, a peer is unreachable from the control plane) and
+   * refuses to guess. It is not a pass: a module whose checks all report
+   * skip is unmeasured, and `system audit` renders the fleet UNKNOWN, not
+   * READY. Never claim `pass` for a probe you did not run (celilo#1326).
+   */
+  status: 'pass' | 'warn' | 'fail' | 'skip';
   message: string;
   details?: string;
 }
@@ -241,6 +248,22 @@ export async function runModuleHealthCheck(
   return finishHealthCheck(moduleId, module.state, checks, db, options, hookResult.artifactPaths);
 }
 
+/**
+ * Derive the module-level verdict from the named checks.
+ *
+ * Pure so the folding rule is testable without a database or a hook
+ * subprocess. `skip` checks are folded toward nothing measured: they are
+ * neither pass nor fail, and a module whose checks all skipped is
+ * `no-checks` — nothing ran that deserves the word healthy.
+ */
+export function deriveHealthStatus(checks: HealthCheckItem[]): HealthCheckResult['status'] {
+  if (checks.some((c) => c.status === 'fail')) return 'unhealthy';
+  if (checks.some((c) => c.status === 'warn')) return 'degraded';
+  const measured = checks.filter((c) => c.status !== 'skip');
+  if (checks.length > 0 && measured.length === 0) return 'no-checks';
+  return 'healthy';
+}
+
 /**
  * Derive the verdict from the named checks and move the module's state.
  *
@@ -255,18 +278,24 @@ function finishHealthCheck(
   options: HealthCheckOptions,
   artifactPaths?: string[],
 ): HealthCheckResult {
-  const hasFail = checks.some((c) => c.status === 'fail');
-  const hasWarn = checks.some((c) => c.status === 'warn');
-
-  const status: HealthCheckResult['status'] = hasFail
-    ? 'unhealthy'
-    : hasWarn
-      ? 'degraded'
-      : 'healthy';
+  const status = deriveHealthStatus(checks);
 
-  const nextState = nextModuleState(moduleState, status, options.unattended ?? false);
+  // Only a run that measured something may move lifecycle state. A module
+  // whose checks all skipped (or that declared no hook) stays as it was —
+  // `VERIFIED` asserts that a check was deliberately run and passed, and
+  // nothing was measured here.
+  const nextState =
+    status === 'healthy' || status === 'degraded' || status === 'unhealthy'
+      ? nextModuleState(moduleState, status, options.unattended ?? false)
+      : null;
   if (nextState) {
-    db.update(modules).set({ state: nextState }).where(eq(modules.id, moduleId)).run();
+    // Moving to VERIFIED/INSTALLED means the module just measured healthy (or
+    // was freshly deployed). Clear a recorded failure with the state, so a
+    // healthy row doesn't keep printing its old `Error:` line (celilo#1363).
+    db.update(modules)
+      .set({ state: nextState, errorMessage: null })
+      .where(eq(modules.id, moduleId))
+      .run();
   }
 
   return { moduleId, status, checks, ...(artifactPaths ? { artifactPaths } : {}) };

package/src/services/infrastructure-selector.test.ts

@@ -10,6 +10,7 @@ import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
 import type { Module } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { addContainerService } from './container-service';
 import { InfrastructureError, selectInfrastructure } from './infrastructure-selector';
 import { addMachine } from './machine-pool';
@@ -46,8 +47,8 @@ describe('infrastructure-selector', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('selectInfrastructure', () => {

package/src/services/infrastructure-variable-resolver.test.ts

@@ -11,6 +11,7 @@ import {
 } from '@/db/schema';
 import type { ModuleManifest } from '@/manifest/schema';
 import { and, eq } from 'drizzle-orm';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { upsertModuleConfig } from './module-config';
 
@@ -38,7 +39,7 @@ beforeEach(() => {
 
 afterEach(async () => {
   db.$client.close();
-  process.env.CELILO_DB_PATH = undefined;
+  resetTestDbPath();
 
   // Clean up database files
   if (existsSync(TEST_DB_PATH)) {

package/src/services/jail-exemptions.test.ts

@@ -0,0 +1,125 @@
+/**
+ * Tests for the shared jail-exemption collector (per-module-jail-policy
+ * task 3.1-3.3).
+ *
+ * Every reporting surface — `module list`, `system doctor`, `system audit` —
+ * builds its view from this one function, so these tests are what stops the
+ * three from disagreeing about what an exemption is. Isolation mirrors
+ * module-jail.test.ts: CELILO_DB_PATH / CELILO_DATA_DIR are set before the
+ * SUT is imported.
+ */
+
+import { afterAll, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+
+const testRoot = mkdtempSync(join(tmpdir(), 'celilo-jail-exemptions-'));
+process.env.CELILO_DB_PATH = join(testRoot, 'celilo.db');
+process.env.CELILO_DATA_DIR = join(testRoot, 'data');
+
+const { getDb, closeDb } = await import('../db/client');
+const { moduleJailPolicies, modules, systemConfig } = await import('../db/schema');
+const { collectJailExemptions } = await import('./jail-exemptions');
+
+function insertModule(id: string): void {
+  getDb()
+    .insert(modules)
+    .values({ id, name: id, sourcePath: `/tmp/${id}`, version: '1.0.0', manifestData: {} })
+    .run();
+}
+
+function setModulePolicy(moduleId: string, policy: string): void {
+  const typed = policy as 'auto' | 'off' | 'required';
+  getDb()
+    .insert(moduleJailPolicies)
+    .values({ moduleId, policy: typed, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: moduleJailPolicies.moduleId,
+      set: { policy: typed, updatedAt: new Date() },
+    })
+    .run();
+}
+
+function setSystemPolicy(value: string | undefined): void {
+  const db = getDb();
+  if (value === undefined) {
+    db.delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+  } else {
+    db.insert(systemConfig)
+      .values({ key: 'hooks.jail_policy', value })
+      .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+      .run();
+  }
+}
+
+afterAll(() => {
+  closeDb();
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe('collectJailExemptions (per-module-jail-policy task 3.4)', () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.delete(moduleJailPolicies).run();
+    db.delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+    db.delete(modules).run();
+    insertModule('strictmod');
+    insertModule('exemptmod');
+  });
+
+  test('no per-module rows produce no exemptions', () => {
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy stronger than the system's is not an exemption", () => {
+    // The fleet default is `off`, so `auto` STRENGTHENS the posture. Reporting
+    // it as an exemption would be a surface reporting an exemption nobody set.
+    setModulePolicy('strictmod', 'required');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy equal to the system's is not an exemption", () => {
+    setSystemPolicy('auto');
+    setModulePolicy('strictmod', 'auto');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy weaker than the system's is reported, with both values", () => {
+    setSystemPolicy('auto');
+    setModulePolicy('exemptmod', 'off');
+    expect(collectJailExemptions(getDb())).toEqual([
+      { moduleId: 'exemptmod', policy: 'off', systemPolicy: 'auto' },
+    ]);
+  });
+
+  test('a weaker exemption against the unset-system default (off) is impossible', () => {
+    // off is the floor; nothing can be weaker than it. This is the negative
+    // half of task 3.4: with nobody having set the system key, no module row
+    // — whatever it holds — may read as an exemption.
+    setModulePolicy('exemptmod', 'off');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test('two exemptions are both reported', () => {
+    insertModule('exemptmod2');
+    setSystemPolicy('required');
+    setModulePolicy('exemptmod', 'auto');
+    setModulePolicy('exemptmod2', 'off');
+    const exemptions = collectJailExemptions(getDb());
+    expect(exemptions).toHaveLength(2);
+    expect(exemptions.map((e) => e.moduleId).sort()).toEqual(['exemptmod', 'exemptmod2']);
+  });
+
+  test('a stored module policy outside the accepted set throws, not coerces', () => {
+    setModulePolicy('exemptmod', 'sometimes');
+    expect(() => collectJailExemptions(getDb())).toThrow(/not a hook jail policy/);
+  });
+
+  test('a stored system policy outside the accepted set throws, naming the fix', () => {
+    setSystemPolicy('jail-harder');
+    setModulePolicy('exemptmod', 'off');
+    expect(() => collectJailExemptions(getDb())).toThrow(/hooks\.jail_policy='jail-harder'/);
+  });
+});

package/src/services/jail-exemptions.ts

@@ -0,0 +1,81 @@
+/**
+ * The per-module jail exemptions, as one query every reporting surface shares
+ * (per-module-jail-policy task 3.1-3.3).
+ *
+ * An exemption is a recorded module policy weaker than the system's
+ * `hooks.jail_policy`. The three surfaces — `module list`'s marker,
+ * `system doctor`'s count, `system audit`'s category — MUST agree on what
+ * that is, so the comparison lives in `isWeakerJailPolicy` and this file only
+ * fetches rows and applies it. A surface that re-derived the definition here
+ * would eventually report a different set from the other two, and a countable
+ * exemption that two surfaces miss is the failure this slice exists to close.
+ *
+ * Read-time refusal follows the rule the resolvers already follow: a stored
+ * value outside the accepted set THROWS (peba's ruling on ce-8832). The set
+ * path validates, so a bad row can only arrive via a restore or a hand edit —
+ * the exact foreign state the rule refuses to coerce into a silent default.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { getDb as getDbType } from '../db/client';
+import { moduleJailPolicies, systemConfig } from '../db/schema';
+import { type JailPolicy, isWeakerJailPolicy, resolveJailPolicy } from '../hooks/jail';
+
+const JAIL_SYSTEM_KEY = 'hooks.jail_policy';
+
+export interface JailExemption {
+  moduleId: string;
+  /** The module's own recorded policy — the weaker of the two. */
+  policy: JailPolicy;
+  /** The system policy it is weaker than: the stored key or the default. */
+  systemPolicy: JailPolicy;
+}
+
+type Db = ReturnType<typeof getDbType>;
+
+/**
+ * The system-wide policy every module without its own row follows.
+ *
+ * Throws on a stored value outside the accepted set, matching the read-time
+ * refusal rule; the error names the fix, and the same throw will be failing
+ * every hook invocation too (the executor resolves through the same key).
+ */
+function systemJailPolicy(db: Db): JailPolicy {
+  const stored = db
+    .select()
+    .from(systemConfig)
+    .where(eq(systemConfig.key, JAIL_SYSTEM_KEY))
+    .get()?.value;
+  if (stored === undefined) return 'off';
+  try {
+    return resolveJailPolicy(undefined, undefined, stored).policy;
+  } catch {
+    throw new Error(
+      `Stored ${JAIL_SYSTEM_KEY}='${stored}' is not a hook jail policy. Fix it with 'celilo system config set ${JAIL_SYSTEM_KEY} <auto|off|required>'.`,
+    );
+  }
+}
+
+/**
+ * Every module running under a recorded policy weaker than the system's.
+ *
+ * A module row stronger than or equal to the system's is NOT an exemption —
+ * the operator strengthened that module's posture, and reporting it as an
+ * exemption would be a phantom finding (per-module-jail-policy task 3.4).
+ * A bad module row throws rather than being skipped or coerced.
+ */
+export function collectJailExemptions(db: Db): JailExemption[] {
+  const system = systemJailPolicy(db);
+  const rows = db.select().from(moduleJailPolicies).all();
+
+  const exemptions: JailExemption[] = [];
+  for (const row of rows) {
+    // Read-time validation through the same resolver the executor uses, so a
+    // hand-edited row fails with the same message here that a hook would get.
+    const policy = resolveJailPolicy(undefined, row.policy, undefined).policy;
+    if (isWeakerJailPolicy(policy, system)) {
+      exemptions.push({ moduleId: row.moduleId, policy, systemPolicy: system });
+    }
+  }
+  return exemptions;
+}

package/src/services/machine-pool.test.ts

@@ -10,6 +10,7 @@ import { eq } from 'drizzle-orm';
 import { closeDb, createDbClient, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { machines, moduleInfrastructure, modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   addMachine,
   getMachine,
@@ -52,8 +53,8 @@ describe('machine-pool', () => {
     }
 
     // Clear environment variables
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    resetTestDbPath();
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('addMachine', () => {

package/src/services/module-config.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { closeDb, createDbClient } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { modules } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   formatConfigValue,
   getAllModuleConfigValues,
@@ -59,7 +60,7 @@ describe('module-config service', () => {
   afterEach(() => {
     closeDb();
     // Clean up environment variable
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     // Clean up test database
     rmSync(testDir, { recursive: true, force: true });
   });

package/src/services/module-deploy.dns-repoint.test.ts

@@ -9,6 +9,7 @@ import { eq } from 'drizzle-orm';
 import { type DbClient, closeDb, getDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import { capabilities, moduleSystems, modules, systemConfig } from '../db/schema';
+import { resetTestDbPath } from '../test-utils/db-path';
 import { InterviewUnansweredError } from './interview-errors';
 import { planDnsRepoint, repointDnsPrimaryForProvider } from './module-deploy';
 
@@ -49,7 +50,7 @@ describe('repointDnsPrimaryForProvider (module-orchestrator-primitives slice 3)'
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-deploy.ts

@@ -4,6 +4,7 @@
  * Coordinates full module deployment workflow across all phases
  */
 
+import { rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ProgressDisplay } from '@celilo/cli-display';
 import { and, eq } from 'drizzle-orm';
@@ -104,6 +105,17 @@ export interface DeployOptions {
    * this mode — that requires a real hook run.
    */
   stopAfterInterview?: boolean;
+  /**
+   * D4 (control-plane-stops-building-modules): retain the generated project
+   * after a successful deploy instead of deleting it. The tree is ephemeral
+   * by design — rendered for this deploy from the signed payload plus live
+   * config, used, then removed — because a persisted generated tree cannot be
+   * validated (only its verbatim role assets have a meaningful digest, the
+   * rest is rendered and SUPPOSED to differ), it holds rendered secrets, and
+   * it is what the next deploy would ship. This flag keeps it for deliberate
+   * inspection. It is always kept when the deploy fails.
+   */
+  keepGeneratedProject?: boolean;
 }
 
 /**
@@ -368,6 +380,26 @@ export async function deployModule(
   closeDeployWindows(db, moduleId, new Date());
 
   if (result.success) {
+    // D4 (control-plane-stops-building-modules): the generated project is
+    // ephemeral. It was rendered for THIS deploy from the signed payload plus
+    // live config; a persisted copy is a tree nothing can validate, it holds
+    // rendered secrets, and it is what a later deploy would ship. Now that
+    // the deploy that needed it is done — ansible, hooks, DNS backfill and
+    // aspects all ran inside the impl — it goes. Kept on failure (the impl's
+    // early returns) and under --keep.
+    if (!options.keepGeneratedProject) {
+      const deployed = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+      if (deployed) {
+        const generatedPath = `${deployed.sourcePath}/generated`;
+        try {
+          rmSync(generatedPath, { recursive: true, force: true });
+          log.info(`Removed generated/ for '${moduleId}' (ephemeral by design; --keep retains it)`);
+        } catch (cleanupError) {
+          const msg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+          log.warn(`Failed to remove generated/ for '${moduleId}': ${msg}`);
+        }
+      }
+    }
     // A module that declares a suggested interval starts being watched on its
     // first successful deploy — watching is the default, not a thing to
     // remember.
@@ -792,26 +824,10 @@ async function deployModuleImpl(
 
     log.success('Templates generated');
 
-    // Pre-flight: refuse before contacting any system if the generated project
-    // does not match the module tree it was generated from (D6).
-    //
-    // This is the check that would have turned celilo#925 from a silent success
-    // into a refusal at the point of the fault. A verbatim role asset that
-    // failed to refresh is invisible downstream: `cp` reports no error, Ansible
-    // copies the stale bytes and reports `ok`, unchanged, and the module's
-    // version advances past code that never shipped. Local, milliseconds, no
-    // SSH. It deliberately does NOT verify after the deploy — Ansible's
-    // `changed` is truthful about what Ansible did, and the lie is upstream of
-    // Ansible.
-    const { refuseIfGeneratedIsStale } = await import('../module/packaging/generated-plane');
-    const staleGenerated = await refuseIfGeneratedIsStale(
-      moduleId,
-      module.sourcePath,
-      generatedPath,
-    );
-    if (staleGenerated) {
-      return { success: false, error: staleGenerated, phases };
-    }
+    // The generated-tree staleness pre-flight (D6 of module-integrity-rigor)
+    // retired here (D5 of control-plane-stops-building-modules): the tree is
+    // rendered for THIS deploy and deleted when it succeeds, so nothing
+    // persists that could be stale relative to what ships.
 
     // Run validate_config hook if defined (e.g., credential validation via Playwright)
     if (manifest.hooks?.validate_config) {
@@ -1032,8 +1048,13 @@ async function deployModuleImpl(
         }
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED. A successful deploy ends any recorded
+      // failure: leaving a stale errorMessage would print `Error:` beside a
+      // healthy state in `module list` / `module status` (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks for config-only modules too
       if (manifest.hooks?.health_check) {
@@ -1700,8 +1721,11 @@ async function deployModuleImpl(
         }
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED; see the first transition for errorMessage (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks after successful deployment
       if (manifest.hooks?.health_check) {

package/src/services/module-operations.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   InFlightError,
   OPERATIONS_SWEEP_PATTERN,
@@ -30,7 +31,7 @@ describe('module-operations', () => {
 
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
+    resetTestDbPath();
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-subscriptions.test.ts

@@ -10,6 +10,7 @@ import { ModuleManifestSchema } from '../manifest/schema';
 import { ModuleSubscriptionSchema } from '../manifest/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { setupTestDatabaseAt as migrateDbFile } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
 import {
   registerModuleSubscriptions,
   resolveSubscription,
@@ -154,7 +155,7 @@ describe('register / unregister roundtrip', () => {
     process.env.EVENT_BUS_DB = dbPath;
   });
   afterEach(() => {
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -341,8 +342,8 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   });
   afterEach(() => {
     closeDb();
-    process.env.CELILO_DB_PATH = undefined;
-    process.env.EVENT_BUS_DB = undefined;
+    resetTestDbPath();
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {