@celilo/cli 2.2.1 → 2.3.0

package/src/services/health-runner.ts

@@ -24,7 +24,14 @@ import { remoteAccessPolicy } from './remote-access';
 
 export interface HealthCheckItem {
   name: string;
-  status: 'pass' | 'warn' | 'fail';
+  /**
+   * `skip` — the check could not perform its real probe (a credential is
+   * not provisioned, a peer is unreachable from the control plane) and
+   * refuses to guess. It is not a pass: a module whose checks all report
+   * skip is unmeasured, and `system audit` renders the fleet UNKNOWN, not
+   * READY. Never claim `pass` for a probe you did not run (celilo#1326).
+   */
+  status: 'pass' | 'warn' | 'fail' | 'skip';
   message: string;
   details?: string;
 }
@@ -241,6 +248,22 @@ export async function runModuleHealthCheck(
   return finishHealthCheck(moduleId, module.state, checks, db, options, hookResult.artifactPaths);
 }
 
+/**
+ * Derive the module-level verdict from the named checks.
+ *
+ * Pure so the folding rule is testable without a database or a hook
+ * subprocess. `skip` checks are folded toward nothing measured: they are
+ * neither pass nor fail, and a module whose checks all skipped is
+ * `no-checks` — nothing ran that deserves the word healthy.
+ */
+export function deriveHealthStatus(checks: HealthCheckItem[]): HealthCheckResult['status'] {
+  if (checks.some((c) => c.status === 'fail')) return 'unhealthy';
+  if (checks.some((c) => c.status === 'warn')) return 'degraded';
+  const measured = checks.filter((c) => c.status !== 'skip');
+  if (checks.length > 0 && measured.length === 0) return 'no-checks';
+  return 'healthy';
+}
+
 /**
  * Derive the verdict from the named checks and move the module's state.
  *
@@ -255,18 +278,24 @@ function finishHealthCheck(
   options: HealthCheckOptions,
   artifactPaths?: string[],
 ): HealthCheckResult {
-  const hasFail = checks.some((c) => c.status === 'fail');
-  const hasWarn = checks.some((c) => c.status === 'warn');
-
-  const status: HealthCheckResult['status'] = hasFail
-    ? 'unhealthy'
-    : hasWarn
-      ? 'degraded'
-      : 'healthy';
+  const status = deriveHealthStatus(checks);
 
-  const nextState = nextModuleState(moduleState, status, options.unattended ?? false);
+  // Only a run that measured something may move lifecycle state. A module
+  // whose checks all skipped (or that declared no hook) stays as it was —
+  // `VERIFIED` asserts that a check was deliberately run and passed, and
+  // nothing was measured here.
+  const nextState =
+    status === 'healthy' || status === 'degraded' || status === 'unhealthy'
+      ? nextModuleState(moduleState, status, options.unattended ?? false)
+      : null;
   if (nextState) {
-    db.update(modules).set({ state: nextState }).where(eq(modules.id, moduleId)).run();
+    // Moving to VERIFIED/INSTALLED means the module just measured healthy (or
+    // was freshly deployed). Clear a recorded failure with the state, so a
+    // healthy row doesn't keep printing its old `Error:` line (celilo#1363).
+    db.update(modules)
+      .set({ state: nextState, errorMessage: null })
+      .where(eq(modules.id, moduleId))
+      .run();
   }
 
   return { moduleId, status, checks, ...(artifactPaths ? { artifactPaths } : {}) };

package/src/services/infrastructure-selector.test.ts

@@ -48,7 +48,7 @@ describe('infrastructure-selector', () => {
 
     // Clear environment variables
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('selectInfrastructure', () => {

package/src/services/jail-exemptions.test.ts

@@ -0,0 +1,125 @@
+/**
+ * Tests for the shared jail-exemption collector (per-module-jail-policy
+ * task 3.1-3.3).
+ *
+ * Every reporting surface — `module list`, `system doctor`, `system audit` —
+ * builds its view from this one function, so these tests are what stops the
+ * three from disagreeing about what an exemption is. Isolation mirrors
+ * module-jail.test.ts: CELILO_DB_PATH / CELILO_DATA_DIR are set before the
+ * SUT is imported.
+ */
+
+import { afterAll, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+
+const testRoot = mkdtempSync(join(tmpdir(), 'celilo-jail-exemptions-'));
+process.env.CELILO_DB_PATH = join(testRoot, 'celilo.db');
+process.env.CELILO_DATA_DIR = join(testRoot, 'data');
+
+const { getDb, closeDb } = await import('../db/client');
+const { moduleJailPolicies, modules, systemConfig } = await import('../db/schema');
+const { collectJailExemptions } = await import('./jail-exemptions');
+
+function insertModule(id: string): void {
+  getDb()
+    .insert(modules)
+    .values({ id, name: id, sourcePath: `/tmp/${id}`, version: '1.0.0', manifestData: {} })
+    .run();
+}
+
+function setModulePolicy(moduleId: string, policy: string): void {
+  const typed = policy as 'auto' | 'off' | 'required';
+  getDb()
+    .insert(moduleJailPolicies)
+    .values({ moduleId, policy: typed, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: moduleJailPolicies.moduleId,
+      set: { policy: typed, updatedAt: new Date() },
+    })
+    .run();
+}
+
+function setSystemPolicy(value: string | undefined): void {
+  const db = getDb();
+  if (value === undefined) {
+    db.delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+  } else {
+    db.insert(systemConfig)
+      .values({ key: 'hooks.jail_policy', value })
+      .onConflictDoUpdate({ target: systemConfig.key, set: { value } })
+      .run();
+  }
+}
+
+afterAll(() => {
+  closeDb();
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe('collectJailExemptions (per-module-jail-policy task 3.4)', () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.delete(moduleJailPolicies).run();
+    db.delete(systemConfig).where(eq(systemConfig.key, 'hooks.jail_policy')).run();
+    db.delete(modules).run();
+    insertModule('strictmod');
+    insertModule('exemptmod');
+  });
+
+  test('no per-module rows produce no exemptions', () => {
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy stronger than the system's is not an exemption", () => {
+    // The fleet default is `off`, so `auto` STRENGTHENS the posture. Reporting
+    // it as an exemption would be a surface reporting an exemption nobody set.
+    setModulePolicy('strictmod', 'required');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy equal to the system's is not an exemption", () => {
+    setSystemPolicy('auto');
+    setModulePolicy('strictmod', 'auto');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test("a module policy weaker than the system's is reported, with both values", () => {
+    setSystemPolicy('auto');
+    setModulePolicy('exemptmod', 'off');
+    expect(collectJailExemptions(getDb())).toEqual([
+      { moduleId: 'exemptmod', policy: 'off', systemPolicy: 'auto' },
+    ]);
+  });
+
+  test('a weaker exemption against the unset-system default (off) is impossible', () => {
+    // off is the floor; nothing can be weaker than it. This is the negative
+    // half of task 3.4: with nobody having set the system key, no module row
+    // — whatever it holds — may read as an exemption.
+    setModulePolicy('exemptmod', 'off');
+    expect(collectJailExemptions(getDb())).toEqual([]);
+  });
+
+  test('two exemptions are both reported', () => {
+    insertModule('exemptmod2');
+    setSystemPolicy('required');
+    setModulePolicy('exemptmod', 'auto');
+    setModulePolicy('exemptmod2', 'off');
+    const exemptions = collectJailExemptions(getDb());
+    expect(exemptions).toHaveLength(2);
+    expect(exemptions.map((e) => e.moduleId).sort()).toEqual(['exemptmod', 'exemptmod2']);
+  });
+
+  test('a stored module policy outside the accepted set throws, not coerces', () => {
+    setModulePolicy('exemptmod', 'sometimes');
+    expect(() => collectJailExemptions(getDb())).toThrow(/not a hook jail policy/);
+  });
+
+  test('a stored system policy outside the accepted set throws, naming the fix', () => {
+    setSystemPolicy('jail-harder');
+    setModulePolicy('exemptmod', 'off');
+    expect(() => collectJailExemptions(getDb())).toThrow(/hooks\.jail_policy='jail-harder'/);
+  });
+});

package/src/services/jail-exemptions.ts

@@ -0,0 +1,81 @@
+/**
+ * The per-module jail exemptions, as one query every reporting surface shares
+ * (per-module-jail-policy task 3.1-3.3).
+ *
+ * An exemption is a recorded module policy weaker than the system's
+ * `hooks.jail_policy`. The three surfaces — `module list`'s marker,
+ * `system doctor`'s count, `system audit`'s category — MUST agree on what
+ * that is, so the comparison lives in `isWeakerJailPolicy` and this file only
+ * fetches rows and applies it. A surface that re-derived the definition here
+ * would eventually report a different set from the other two, and a countable
+ * exemption that two surfaces miss is the failure this slice exists to close.
+ *
+ * Read-time refusal follows the rule the resolvers already follow: a stored
+ * value outside the accepted set THROWS (peba's ruling on ce-8832). The set
+ * path validates, so a bad row can only arrive via a restore or a hand edit —
+ * the exact foreign state the rule refuses to coerce into a silent default.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { getDb as getDbType } from '../db/client';
+import { moduleJailPolicies, systemConfig } from '../db/schema';
+import { type JailPolicy, isWeakerJailPolicy, resolveJailPolicy } from '../hooks/jail';
+
+const JAIL_SYSTEM_KEY = 'hooks.jail_policy';
+
+export interface JailExemption {
+  moduleId: string;
+  /** The module's own recorded policy — the weaker of the two. */
+  policy: JailPolicy;
+  /** The system policy it is weaker than: the stored key or the default. */
+  systemPolicy: JailPolicy;
+}
+
+type Db = ReturnType<typeof getDbType>;
+
+/**
+ * The system-wide policy every module without its own row follows.
+ *
+ * Throws on a stored value outside the accepted set, matching the read-time
+ * refusal rule; the error names the fix, and the same throw will be failing
+ * every hook invocation too (the executor resolves through the same key).
+ */
+function systemJailPolicy(db: Db): JailPolicy {
+  const stored = db
+    .select()
+    .from(systemConfig)
+    .where(eq(systemConfig.key, JAIL_SYSTEM_KEY))
+    .get()?.value;
+  if (stored === undefined) return 'off';
+  try {
+    return resolveJailPolicy(undefined, undefined, stored).policy;
+  } catch {
+    throw new Error(
+      `Stored ${JAIL_SYSTEM_KEY}='${stored}' is not a hook jail policy. Fix it with 'celilo system config set ${JAIL_SYSTEM_KEY} <auto|off|required>'.`,
+    );
+  }
+}
+
+/**
+ * Every module running under a recorded policy weaker than the system's.
+ *
+ * A module row stronger than or equal to the system's is NOT an exemption —
+ * the operator strengthened that module's posture, and reporting it as an
+ * exemption would be a phantom finding (per-module-jail-policy task 3.4).
+ * A bad module row throws rather than being skipped or coerced.
+ */
+export function collectJailExemptions(db: Db): JailExemption[] {
+  const system = systemJailPolicy(db);
+  const rows = db.select().from(moduleJailPolicies).all();
+
+  const exemptions: JailExemption[] = [];
+  for (const row of rows) {
+    // Read-time validation through the same resolver the executor uses, so a
+    // hand-edited row fails with the same message here that a hook would get.
+    const policy = resolveJailPolicy(undefined, row.policy, undefined).policy;
+    if (isWeakerJailPolicy(policy, system)) {
+      exemptions.push({ moduleId: row.moduleId, policy, systemPolicy: system });
+    }
+  }
+  return exemptions;
+}

package/src/services/machine-pool.test.ts

@@ -54,7 +54,7 @@ describe('machine-pool', () => {
 
     // Clear environment variables
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('addMachine', () => {

package/src/services/module-deploy.ts

@@ -1048,8 +1048,13 @@ async function deployModuleImpl(
         }
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED. A successful deploy ends any recorded
+      // failure: leaving a stale errorMessage would print `Error:` beside a
+      // healthy state in `module list` / `module status` (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks for config-only modules too
       if (manifest.hooks?.health_check) {
@@ -1716,8 +1721,11 @@ async function deployModuleImpl(
         }
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED; see the first transition for errorMessage (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks after successful deployment
       if (manifest.hooks?.health_check) {

package/src/services/module-subscriptions.test.ts

@@ -155,7 +155,7 @@ describe('register / unregister roundtrip', () => {
     process.env.EVENT_BUS_DB = dbPath;
   });
   afterEach(() => {
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -343,7 +343,7 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/network-discovery.test.ts

@@ -15,8 +15,9 @@
 import { beforeEach, describe, expect, test } from 'bun:test';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { modules, systemConfig } from '../db/schema';
 import { setupTestDatabase } from '../test-utils/database';
+import { CONTROL_PLANE_MODULE_ID, upsertDeployedSystem } from './deployed-systems';
 import {
   discoverAndRecordNetwork,
   discoveredNetworkKeys,
@@ -102,6 +103,33 @@ describe('discoveredNetworkKeys (issue #300 redeploy idempotency)', () => {
     });
   });
 
+  test('first install with control plane in secure-mgmt records there (celilo#1356)', () => {
+    // The default topology (ce-8mxz) puts celilo-mgr on secure-mgmt, so a fresh
+    // segmented bootstrap must not file the control-plane subnet under
+    // `network.internal.*` — celilo would otherwise be blind to its own
+    // internal zone.
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'secure-mgmt' })).toEqual({
+      'network.secure-mgmt.subnet': '192.168.1.0/24',
+      'network.secure-mgmt.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install with control plane in internal is unchanged', () => {
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'internal' })).toEqual({
+      'network.internal.subnet': '192.168.1.0/24',
+      'network.internal.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install never clobbers an already-set control-plane zone value', () => {
+    expect(
+      discoveredNetworkKeys(internal, false, {
+        controlPlaneZone: 'secure-mgmt',
+        secureMgmtAlreadySet: true,
+      }),
+    ).toEqual({});
+  });
+
   test('preserves an already-set subnet on redeploy (no override)', () => {
     // The regression: a redeploy on a box off the internal network discovers the
     // WRONG subnet — it must not clobber the operator's value.
@@ -165,6 +193,41 @@ describe('discoverAndRecordNetwork', () => {
     expect(read('network.internal.gateway')).toBe('10.31.7.1');
   });
 
+  test('first install for a control plane deployed in secure-mgmt records secure-mgmt (celilo#1356)', () => {
+    // Seed the module_systems row the deploy pipeline writes before
+    // bootstrapControlPlane runs, placing celilo-mgmt in secure-mgmt.
+    db.insert(modules)
+      .values({
+        id: CONTROL_PLANE_MODULE_ID,
+        name: 'Celilo Management Server',
+        version: '0.9.0',
+        manifestData: {},
+        sourcePath: '/tmp/modules/celilo-mgmt',
+      })
+      .run();
+    upsertDeployedSystem(db, CONTROL_PLANE_MODULE_ID, {
+      name: 'main',
+      hostname: 'celilo-mgr',
+      ipv4Address: '10.226.120.10',
+      zone: 'secure-mgmt',
+      infraType: 'machine',
+      machineId: null,
+      serviceId: null,
+      vmid: null,
+    });
+
+    const result = discoverAndRecordNetwork(db, () =>
+      ipRouteFor('10.226.120.0', '10.226.120.1', '10.226.120.10'),
+    );
+
+    expect(result.applied).toEqual([
+      'network.secure-mgmt.subnet = 10.226.120.0/24',
+      'network.secure-mgmt.gateway = 10.226.120.1',
+    ]);
+    expect(read('network.internal.subnet')).toBeUndefined();
+    expect(read('network.secure-mgmt.subnet')).toBe('10.226.120.0/24');
+  });
+
   test('a redeploy on the same box changes nothing and says so', () => {
     const routes = () => ipRouteFor('10.31.7.0', '10.31.7.1', '10.31.7.20');
     discoverAndRecordNetwork(db, routes);

package/src/services/network-discovery.ts

@@ -24,7 +24,8 @@
 import { execFileSync } from 'node:child_process';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { type NetworkZone, systemConfig } from '../db/schema';
+import { CONTROL_PLANE_MODULE_ID, asZone, getModuleSystems } from './deployed-systems';
 
 export interface DiscoveredNetwork {
   subnet: string;
@@ -61,7 +62,14 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
  *    LAN, so what it discovered IS `internal`. First install records it there.
  *  - Segmented deployment: the box sits on a dedicated control-plane network.
  *    `internal` is then someone else's subnet — the semi-trusted LAN — and the
- *    discovered value belongs under `secure-mgmt`.
+ *    discovered value belongs under the control plane's own zone (`secure-mgmt`
+ *    in the default topology, celilo#1356).
+ *
+ * On FIRST INSTALL the zone is decided the same way the rest of celilo decides
+ * it: from where the control plane actually landed. `discoverAndRecordNetwork`
+ * reads `celilo-mgmt`'s deployed-system row and passes that zone in as
+ * `opts.controlPlaneZone`; with no row recorded yet the fallback stays
+ * `internal`, the pre-#1356 behaviour.
  *
  * Issue #300 spotted the second case as "discovery returns the WRONG subnet" and
  * mitigated it by DISCARDING the value whenever `internal` was already set. That
@@ -76,14 +84,21 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
 export function discoveredNetworkKeys(
   host: DiscoveredNetwork | null,
   internalAlreadySet: boolean,
-  opts: { internalSubnet?: string; secureMgmtAlreadySet?: boolean } = {},
+  opts: {
+    internalSubnet?: string;
+    secureMgmtAlreadySet?: boolean;
+    /** Zone the control plane itself occupies; first install records there, not `internal`. */
+    controlPlaneZone?: NetworkZone;
+  } = {},
 ): Record<string, string> {
   if (!host) return {};
 
   if (!internalAlreadySet) {
+    const targetZone = opts.controlPlaneZone ?? 'internal';
+    if (targetZone !== 'internal' && opts.secureMgmtAlreadySet) return {};
     return {
-      'network.internal.subnet': host.subnet,
-      'network.internal.gateway': host.gateway,
+      [`network.${targetZone}.subnet`]: host.subnet,
+      [`network.${targetZone}.gateway`]: host.gateway,
     };
   }
 
@@ -118,6 +133,15 @@ function readValue(db: DbClient, key: string): string | undefined {
   return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value ?? undefined;
 }
 
+/**
+ * The zone the control plane actually landed in, from its deployed-system row
+ * (same source `loadControlPlaneSubnet` reads). Undefined when celilo-mgmt has
+ * no system recorded yet, so the caller falls back to `internal`.
+ */
+function controlPlaneZone(db: DbClient): NetworkZone | undefined {
+  return asZone(getModuleSystems(CONTROL_PLANE_MODULE_ID, db)[0]?.zone) ?? undefined;
+}
+
 /**
  * Discover the network this box sits on and record it. Idempotent, and never
  * overwrites a value that is already set.
@@ -143,6 +167,7 @@ export function discoverAndRecordNetwork(
   const keys = discoveredNetworkKeys(host, internalSubnet !== undefined, {
     internalSubnet,
     secureMgmtAlreadySet: readValue(db, 'network.secure-mgmt.subnet') !== undefined,
+    controlPlaneZone: controlPlaneZone(db),
   });
 
   const applied: string[] = [];

package/src/services/responder-probe.test.ts

@@ -32,7 +32,7 @@ describe('ensureResponderForInterview (ISS-0025)', () => {
     origTTY = process.stdin.isTTY;
   });
   afterEach(() => {
-    if (origEnv === undefined) process.env.EVENT_BUS_DB = undefined;
+    if (origEnv === undefined) delete process.env.EVENT_BUS_DB;
     else process.env.EVENT_BUS_DB = origEnv;
     setTTY(origTTY);
     try {

package/src/services/restore-from-file.test.ts

@@ -46,8 +46,8 @@ describe('applyStagedSystemFiles', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -207,8 +207,8 @@ describe('restoreFromArtifactFile error paths', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/restore-preflight.test.ts

@@ -25,7 +25,7 @@ describe('restore pre-flight', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/ssh-key-manager.test.ts

@@ -99,8 +99,8 @@ describe('ssh-key-manager', () => {
 
     // Clear environment variables
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('writeTemporarySshKey', () => {

package/src/services/system-state-stage.test.ts

@@ -38,9 +38,9 @@ describe('stageSystemState', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     rmSync(dataDir, { recursive: true, force: true });
   });
 

package/src/services/update/orchestrator.test.ts

@@ -78,6 +78,7 @@ const cleanAudit: AuditDeps = {
   moduleConfigs: { modules: [] },
   moduleIntegrity: { results: [] },
   detectWithoutConverge: { modules: [] },
+  jailExemptions: { exemptions: [] },
   health: { results: [] },
   backups: { modules: [] },
   abandonedOperations: { records: [] },
@@ -87,6 +88,7 @@ const cleanAudit: AuditDeps = {
   secretsDecryptable: { results: [] },
   servicesReachable: { results: [] },
   machinesReachable: { results: [] },
+  diskSpace: { results: [] },
   transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
   trustedSources: { firewalls: [] },
   publicDns: { records: [], probe: unusedPublicDnsProbe },

package/src/test-utils/bus-responder.ts

@@ -130,7 +130,7 @@ export function startBusResponderFixture(opts: BusResponderFixtureOptions): BusR
     close: () => {
       handle.close();
       db.$client.close();
-      if (prevDataDir === undefined) process.env.CELILO_DATA_DIR = undefined;
+      if (prevDataDir === undefined) delete process.env.CELILO_DATA_DIR;
       else process.env.CELILO_DATA_DIR = prevDataDir;
       // Reset to the scratch path, never restore the previous value: it may
       // be another suite's temp database, or unset — which sends the next