@celilo/cli 2.2.1 → 2.3.0

package/src/cli/commands/module-publish.test.ts

@@ -43,7 +43,7 @@ describe('handleModulePublish — validation', () => {
     // will skip the validation path it's trying to exercise.
     const origToken = process.env.CELILO_PUBLISH_TOKEN;
     const origDataDir = process.env.CELILO_DATA_DIR;
-    process.env.CELILO_PUBLISH_TOKEN = undefined;
+    delete process.env.CELILO_PUBLISH_TOKEN;
     process.env.CELILO_DB_PATH = `/tmp/test-celilo-no-token-${Date.now()}.db`;
     process.env.CELILO_DATA_DIR = `/tmp/test-celilo-data-${Date.now()}`;
     try {
@@ -54,7 +54,7 @@ describe('handleModulePublish — validation', () => {
       if (origToken !== undefined) process.env.CELILO_PUBLISH_TOKEN = origToken;
       resetTestDbPath();
       if (origDataDir !== undefined) process.env.CELILO_DATA_DIR = origDataDir;
-      else process.env.CELILO_DATA_DIR = undefined;
+      else delete process.env.CELILO_DATA_DIR;
     }
   });
 
@@ -169,7 +169,7 @@ describe('resolveToken — precedence', () => {
       expect(t).toBe('flag-token');
     } finally {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
-      else process.env.CELILO_PUBLISH_TOKEN = undefined;
+      else delete process.env.CELILO_PUBLISH_TOKEN;
       resetTestDbPath();
     }
   });
@@ -183,7 +183,7 @@ describe('resolveToken — precedence', () => {
       expect(t).toBe('env-token');
     } finally {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
-      else process.env.CELILO_PUBLISH_TOKEN = undefined;
+      else delete process.env.CELILO_PUBLISH_TOKEN;
       resetTestDbPath();
     }
   });
@@ -193,7 +193,7 @@ describe('resolveToken — precedence', () => {
     // DB and returns null gracefully.
     const origEnv = process.env.CELILO_PUBLISH_TOKEN;
     const origDataDir = process.env.CELILO_DATA_DIR;
-    process.env.CELILO_PUBLISH_TOKEN = undefined;
+    delete process.env.CELILO_PUBLISH_TOKEN;
     process.env.CELILO_DB_PATH = `/tmp/test-celilo-resolve-empty-${Date.now()}.db`;
     process.env.CELILO_DATA_DIR = `/tmp/test-celilo-data-empty-${Date.now()}`;
     try {
@@ -203,7 +203,7 @@ describe('resolveToken — precedence', () => {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
       resetTestDbPath();
       if (origDataDir !== undefined) process.env.CELILO_DATA_DIR = origDataDir;
-      else process.env.CELILO_DATA_DIR = undefined;
+      else delete process.env.CELILO_DATA_DIR;
     }
   });
 });

package/src/cli/commands/module-update.test.ts

@@ -107,12 +107,15 @@ description: fixture
     // Seed the modules table with the "currently installed" record.
     // We deliberately put a registry-style version string in here so
     // displayVersion-less upgrades preserve the previousVersion field.
+    // celilo#1363: updatedAt is seeded frozen so the success assertions can
+    // prove the stamp actually happens whenever the version moves.
     db.insert(modules)
       .values({
         id: 'testmod',
         name: 'Test Module',
         sourcePath: installedDir,
         version: '1.0.0+5',
+        updatedAt: new Date('2026-04-25T16:26:31Z'),
         manifestData: {
           celilo_contract: '1.0',
           id: 'testmod',
@@ -126,7 +129,7 @@ description: fixture
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('returns previousVersion + newVersion in the success outcome', async () => {
@@ -153,6 +156,18 @@ description: fixture
     expect(row.version).toBe('1.0.0+6');
   });
 
+  // celilo#1363: the version moved (1.0.5+5 → +6) while updatedAt stayed at
+  // 2026-04-25, so the audit read the module as untouched and fine. The stamp
+  // must happen in updateOne itself, where every version write lives.
+  test('writing a new version stamps updatedAt', async () => {
+    const result = await updateOne(srcDir, db, {}, { quiet: true, displayVersion: '1.0.0+6' });
+    expect(result.status).toBe('success');
+
+    const row = db.select().from(modules).all()[0];
+    expect(row.version).toBe('1.0.0+6');
+    expect(row.updatedAt?.getTime()).toBeGreaterThan(new Date('2026-04-25T16:26:31Z').getTime());
+  });
+
   test('quiet=true suppresses the per-call log lines (caller renders its own)', async () => {
     // We can't easily intercept the log helpers' output without adding test
     // hooks, so instead we exercise that the call simply succeeds and
@@ -257,7 +272,7 @@ subscriptions:
         bus.close();
       }
     } finally {
-      process.env.EVENT_BUS_DB = undefined;
+      delete process.env.EVENT_BUS_DB;
     }
   });
 });
@@ -315,8 +330,8 @@ describe('registry sweep — an unanswered breaking update is not a decline', ()
     server.stop(true);
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
+    delete process.env.EVENT_BUS_DB;
   });
 
   test('reports it as unanswered, never as declined, and fails the sweep', async () => {
@@ -389,7 +404,7 @@ description: fixture
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('refuses by name, and writes NOTHING', async () => {
@@ -501,7 +516,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('a failed update leaves the installed tree byte-identical', async () => {
@@ -596,7 +611,7 @@ describe('updateOne — a .netapp package source', () => {
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   // ce-h4of: the temp-dir cleanup ran BEFORE the staged swap, and

package/src/cli/commands/module-update.ts

@@ -475,12 +475,15 @@ export async function updateOne(
 
   // Update manifest in database. We persist the display version (with
   // +N when known) so subsequent `module list` / `module update` calls
-  // see the same version string the registry reported.
+  // see the same version string the registry reported. updatedAt moves with
+  // the version: a frozen timestamp beside a new version read as "nothing
+  // happened here" to the audit (celilo#1363).
   db.update(modules)
     .set({
       manifestData: newManifest as unknown as Record<string, unknown>,
       version: newVersion,
       name: newManifest.name,
+      updatedAt: new Date(),
     })
     .where(eq(modules.id, moduleId))
     .run();

package/src/cli/commands/module-upgrade.test.ts

@@ -1,5 +1,16 @@
-import { describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import type { Mock } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { create as tarCreate } from 'tar';
+import { type DbClient, getDb } from '../../db/client';
+import { type ModuleState, modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { RegistryClient } from '../../registry/client';
+import * as moduleDeploy from '../../services/module-deploy';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type PollCandidate,
   isPollInvocation,
@@ -8,6 +19,7 @@ import {
   pickAutoUpgrade,
   pickUpgradePolicy,
   selectPollTargets,
+  upgradeOneModule,
 } from './module-upgrade';
 
 /** Minimal manifest fixture; only `hooks` matters for the backup gate. */
@@ -70,6 +82,7 @@ describe('selectPollTargets (ISS-0139 — opted-in + a newer registry version)',
     installed: '1.0.0',
     latest: '1.0.1',
     autoUpgrade: true,
+    inError: false,
     ...over,
   });
 
@@ -92,6 +105,13 @@ describe('selectPollTargets (ISS-0139 — opted-in + a newer registry version)',
     expect(selectPollTargets([base({ latest: null })])).toEqual([]);
   });
 
+  // celilo#1363: the poll burned five attempts redeploying celilo-website
+  // against a failure that never went away. A module in ERROR stays skipped
+  // until an attended health check clears it.
+  test('skips modules in ERROR state (a failed upgrade deploy)', () => {
+    expect(selectPollTargets([base({ inError: true })])).toEqual([]);
+  });
+
   test('picks only the eligible subset from a mixed set', () => {
     const targets = selectPollTargets([
       base({ moduleId: 'a', installed: '1.0.0', latest: '1.0.1', autoUpgrade: true }),
@@ -136,3 +156,97 @@ describe('needsPreUpgradeBackup (ISS-0168 — gate on the TARGET version manifes
     expect(needsPreUpgradeBackup('safe', manifest(undefined))).toBe(false);
   });
 });
+
+// celilo#1363: fetchAndUpdate commits the new version to the store BEFORE the
+// deploy runs, so a failed deploy left a new version recorded beside a stale
+// VERIFIED state and a frozen updatedAt, and the audit read the module as
+// fine. Option A: the row must say what happened — state ERROR with the
+// error, and updatedAt moving whenever the version moves.
+describe('upgradeOneModule — a failed deploy records the failure in the row (celilo#1363)', () => {
+  const FROZEN = new Date('2026-04-25T16:26:31Z');
+  let tempDir: string;
+  let installedDir: string;
+  let db: DbClient;
+  let getIndexSpy: Mock<(name: string) => Promise<unknown[]>>;
+  let downloadSpy: Mock<(name: string, vers: string, cksum?: string) => Promise<ArrayBuffer>>;
+  let deploySpy: Mock<typeof moduleDeploy.deployModule>;
+
+  beforeEach(async () => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-upgrade-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+
+    installedDir = join(tempDir, 'installed', 'testmod');
+    mkdirSync(installedDir, { recursive: true });
+    writeFileSync(
+      join(installedDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+    );
+
+    db = getDb();
+    db.insert(modules)
+      .values({
+        id: 'testmod',
+        name: 'Test Module',
+        sourcePath: installedDir,
+        version: '1.0.0+5',
+        state: 'VERIFIED',
+        updatedAt: FROZEN,
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'testmod',
+          name: 'Test Module',
+          version: '1.0.0',
+        },
+      })
+      .run();
+
+    // Build the registry package for a patch bump (1.0.0+5 → 1.0.0+6).
+    // Patch/revision → fast posture, so no snapshot and no backup are needed
+    // on the path to the deploy.
+    const srcDir = join(tempDir, 'pkg-src');
+    mkdirSync(srcDir, { recursive: true });
+    writeFileSync(
+      join(srcDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
+    );
+    const pkgPath = join(tempDir, 'testmod-1.0.0.netapp');
+    await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);
+    const pkgBytes = new Uint8Array(await Bun.file(pkgPath).arrayBuffer());
+
+    getIndexSpy = spyOn(RegistryClient.prototype, 'getIndex').mockResolvedValue([
+      { name: 'testmod', vers: '1.0.0+6', deps: [], cksum: 'abc', yanked: false },
+    ]);
+    downloadSpy = spyOn(RegistryClient.prototype, 'download').mockResolvedValue(pkgBytes.buffer);
+    deploySpy = spyOn(moduleDeploy, 'deployModule').mockResolvedValue({
+      success: false,
+      error: 'ssh: connection refused',
+      phases: {},
+    });
+  });
+
+  afterEach(() => {
+    getIndexSpy.mockRestore();
+    downloadSpy.mockRestore();
+    deploySpy.mockRestore();
+    rmSync(tempDir, { recursive: true, force: true });
+    resetTestDbPath();
+    delete process.env.CELILO_ORIGINAL_CWD;
+  });
+
+  test('a deploy failure leaves state ERROR, the new version, and a moved updatedAt', async () => {
+    const mod = db.select().from(modules).where(eq(modules.id, 'testmod')).get();
+    if (!mod) throw new Error('seed row missing');
+
+    const result = await upgradeOneModule(mod, '1.0.0+6', new RegistryClient(''), db, {});
+
+    expect(result.success).toBe(false);
+    const row = db.select().from(modules).where(eq(modules.id, 'testmod')).get();
+    if (!row) throw new Error('row missing after upgrade');
+    expect(row.version).toBe('1.0.0+6');
+    expect(row.state).toBe<ModuleState>('ERROR');
+    expect(row.errorMessage).toContain('1.0.0+6');
+    expect(row.errorMessage).toContain('ssh: connection refused');
+    expect(row.updatedAt?.getTime()).toBeGreaterThan(FROZEN.getTime());
+  });
+});

package/src/cli/commands/module-upgrade.ts

@@ -127,6 +127,8 @@ export interface PollCandidate {
   /** Latest registry version, or null when the module isn't on the registry. */
   latest: string | null;
   autoUpgrade: boolean;
+  /** True when the module row carries state ERROR (a failed upgrade, celilo#1363). */
+  inError: boolean;
 }
 
 export interface PollTarget {
@@ -144,6 +146,10 @@ export function selectPollTargets(candidates: PollCandidate[]): PollTarget[] {
   const targets: PollTarget[] = [];
   for (const c of candidates) {
     if (!c.autoUpgrade || !c.latest) continue;
+    // A module in ERROR failed an upgrade already. Retrying it on every poll
+    // redeploys the same broken version indefinitely (celilo#1363), so skip it
+    // until an attended health check clears the state (healthy → VERIFIED).
+    if (c.inError) continue;
     const change = classifyVersionChange(c.installed, c.latest);
     if (change === 'up-to-date' || change === 'ahead') continue;
     targets.push({ moduleId: c.moduleId, from: c.installed, to: c.latest });
@@ -163,8 +169,10 @@ function resolveAutoUpgrade(moduleId: string): boolean {
  * Upgrade ONE module to a known target version: posture → update → backup →
  * deploy → verify. The shared core for both the single-module command and the
  * poll. `mod` is the current DB row; `targetVersion` is the registry latest.
+ * Exported for tests: the failure paths here are where the store diverges from
+ * reality (celilo#1363).
  */
-async function upgradeOneModule(
+export async function upgradeOneModule(
   mod: typeof modules.$inferSelect,
   targetVersion: string,
   client: RegistryClient,
@@ -237,6 +245,19 @@ async function upgradeOneModule(
   // Deploy (idempotent).
   const deployed = await deployModule(moduleId, db, {});
   if (!deployed.success) {
+    // fetchAndUpdate already swapped the files and wrote the new version to
+    // the store, so the recorded version no longer matches anything verified.
+    // Record the failure in the state rather than leaving a stale VERIFIED
+    // beside the new version (celilo#1363, option A). An attended health check
+    // that passes moves ERROR → VERIFIED and clears the record.
+    db.update(modules)
+      .set({
+        state: 'ERROR',
+        errorMessage: `Upgrade to ${targetVersion} failed to deploy: ${deployed.error}`,
+        updatedAt: new Date(),
+      })
+      .where(eq(modules.id, moduleId))
+      .run();
     return {
       success: false,
       error: `Deploy failed for ${moduleId} (now at ${targetVersion}): ${deployed.error}`,
@@ -288,6 +309,7 @@ async function runRegistryPoll(
       installed: mod.version,
       latest: await latestRegistryVersion(client, mod.id),
       autoUpgrade: resolveAutoUpgrade(mod.id),
+      inError: mod.state === 'ERROR',
     });
   }
 

package/src/cli/commands/module-verify.test.ts

@@ -30,7 +30,7 @@ describe('moduleAudit (deprecation alias)', () => {
   afterEach(() => {
     rmSync(dataDir, { recursive: true, force: true });
     resetTestDbPath();
-    if (originalDataDir === undefined) process.env.CELILO_DATA_DIR = undefined;
+    if (originalDataDir === undefined) delete process.env.CELILO_DATA_DIR;
     else process.env.CELILO_DATA_DIR = originalDataDir;
   });
 

package/src/cli/commands/publish/execute.ts

@@ -63,7 +63,10 @@ export async function executePlan(input: ExecutePlanInput): Promise<PublishResul
   }
 
   if (plan.modulePublish.length > 0) {
-    executeModulePublish(plan.modulePublish, { allowStale: plan.options.allowStale });
+    executeModulePublish(plan.modulePublish, {
+      allowStale: plan.options.allowStale,
+      skippedModules: plan.options.skippedModules,
+    });
   }
 
   return result;

package/src/cli/commands/publish/index.ts

@@ -20,6 +20,7 @@
  *   celilo publish --release-touch                  # auto-fix module stale-drift
  *   celilo publish --allow-stale                    # skip stale-version safeguards
  *   celilo publish -y / --yes                       # auto-confirm prompts
+ *   celilo publish --skip-module <id>               # leave a module out of the registry sweep
  *   celilo publish --alpha                          # X.Y.Z-alpha.N to @alpha
  *   celilo publish --alpha --track-alpha            # also force-pin alphas globally
  *   celilo publish --alpha --alpha-modules          # also publish module +N
@@ -120,6 +121,15 @@ export function parseOptions(argv: string[]): ParsedFlags {
   const alphaModulesFlag = argv.includes('--alpha-modules');
   const skipChangesets = argv.includes('--skip-changesets');
   const promoteArg = takeFlagValue('--promote');
+  const skippedModules: string[] = [];
+  for (let i = argv.indexOf('--skip-module'); i >= 0; i = argv.indexOf('--skip-module', i + 1)) {
+    const id = argv[i + 1];
+    if (id === undefined || id.startsWith('-')) {
+      console.error('✗ --skip-module requires a module id (e.g. --skip-module homebridge)');
+      process.exit(1);
+    }
+    skippedModules.push(id);
+  }
 
   if (alphaFlag && promoteArg) {
     console.error('✗ --alpha and --promote are mutually exclusive.');
@@ -152,7 +162,7 @@ export function parseOptions(argv: string[]): ParsedFlags {
   }
 
   return {
-    options: { allowStale, autoYes: yes, mode },
+    options: { allowStale, autoYes: yes, mode, skippedModules },
     dryRun,
     releaseTouch,
     skipChangesets,

package/src/cli/commands/publish/module-registry.test.ts

@@ -8,7 +8,7 @@
  */
 
 import { describe, expect, test } from 'bun:test';
-import { mapModuleDirsToItems } from './module-registry';
+import { applyModuleSkips, mapModuleDirsToItems } from './module-registry';
 
 describe('mapModuleDirsToItems', () => {
   test('empty input → empty plan', () => {
@@ -38,3 +38,26 @@ describe('mapModuleDirsToItems', () => {
     ]);
   });
 });
+
+describe('applyModuleSkips', () => {
+  const items = mapModuleDirsToItems([
+    '/repo/modules/caddy',
+    '/repo/modules/burner',
+    '/repo/modules/homebridge',
+  ]);
+
+  test('no skips leaves the plan unchanged', () => {
+    expect(applyModuleSkips(items, [])).toEqual(items);
+  });
+
+  test('drops each named module and keeps the order of the rest', () => {
+    expect(applyModuleSkips(items, ['burner']).map((m) => m.moduleDir)).toEqual([
+      '/repo/modules/caddy',
+      '/repo/modules/homebridge',
+    ]);
+  });
+
+  test('a name that matches no module directory throws and names it', () => {
+    expect(() => applyModuleSkips(items, ['burnr'])).toThrow('burnr');
+  });
+});

package/src/cli/commands/publish/module-registry.ts

@@ -11,7 +11,7 @@
 
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { join, relative } from 'node:path';
+import { basename, join, relative } from 'node:path';
 import { REPO_ROOT, listModuleDirs } from './helpers';
 import type { ModuleItem } from './types';
 
@@ -28,13 +28,31 @@ export function mapModuleDirsToItems(dirs: string[]): ModuleItem[] {
   return dirs.map((moduleDir) => ({ moduleDir }));
 }
 
-export function planModulePublish(): ModuleItem[] {
-  return mapModuleDirsToItems(listModuleDirs());
+/**
+ * Leave the modules named by `--skip-module` out of the sweep. A name
+ * that matches no module directory throws, so a typo cannot skip
+ * nothing and publish the module it meant to hold back.
+ */
+export function applyModuleSkips(items: ModuleItem[], skippedModules: string[]): ModuleItem[] {
+  const known = new Set(items.map((m) => basename(m.moduleDir)));
+  const unknown = skippedModules.filter((id) => !known.has(id));
+  if (unknown.length > 0) {
+    throw new Error(`--skip-module names no module directory: ${unknown.join(', ')}`);
+  }
+  const skipped = new Set(skippedModules);
+  return items.filter((m) => !skipped.has(basename(m.moduleDir)));
+}
+
+export function planModulePublish(skippedModules: string[]): ModuleItem[] {
+  return applyModuleSkips(mapModuleDirsToItems(listModuleDirs()), skippedModules);
 }
 
 // ─── Executor ──────────────────────────────────────────────────────
 
-export function executeModulePublish(items: ModuleItem[], opts: { allowStale: boolean }): void {
+export function executeModulePublish(
+  items: ModuleItem[],
+  opts: { allowStale: boolean; skippedModules: string[] },
+): void {
   if (items.length === 0) {
     console.log('\nNo modules with manifest.yml found — skipping module-publish phase.');
     return;
@@ -49,6 +67,7 @@ export function executeModulePublish(items: ModuleItem[], opts: { allowStale: bo
   console.log('\n──────────────────────────────────────────────');
   console.log(' Publishing modules to celilo registry');
   console.log('──────────────────────────────────────────────');
+  for (const id of opts.skippedModules) console.log(`  modules/${id}  (skipped: --skip-module)`);
   for (const m of items) console.log(`  ${relative(REPO_ROOT, m.moduleDir)}`);
   console.log();
 

package/src/cli/commands/publish/plan.ts

@@ -76,7 +76,7 @@ export function planPublish(opts: PublishOptions): PublishPlan {
           trackAlpha: opts.mode.kind === 'alpha' && opts.mode.trackAlpha,
         })
       : [],
-    modulePublish: runPhase4 ? planModulePublish() : [],
+    modulePublish: runPhase4 ? planModulePublish(opts.skippedModules) : [],
   };
 }
 

package/src/cli/commands/publish/types.ts

@@ -61,6 +61,13 @@ export interface PublishOptions {
   allowStale: boolean;
   autoYes: boolean;
   mode: PublishMode;
+  /**
+   * Module ids to leave out of the module-registry sweep (`--skip-module
+   * <id>`, repeatable). For a module that cannot publish yet. The sweep
+   * stops at its first failed module, so one such module would otherwise
+   * take every module after it, and the release's .deb, down with it.
+   */
+  skippedModules: string[];
 }
 
 /**

package/src/cli/commands/registry-owner.test.ts

@@ -45,7 +45,7 @@ describe('registry owner commands', () => {
   afterEach(async () => {
     fetchSpy.mockRestore();
     closeDb();
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     resetTestDbPath();
     if (existsSync(dataDir)) await rm(dataDir, { recursive: true, force: true });
   });

package/src/cli/commands/registry-token.test.ts

@@ -50,7 +50,7 @@ describe('registry token add/rm (F2 clobber fix)', () => {
 
   afterEach(async () => {
     closeDb();
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     resetTestDbPath();
     if (existsSync(dataDir)) {
       await rm(dataDir, { recursive: true, force: true });

package/src/cli/commands/system-audit.ts

@@ -45,7 +45,6 @@ import {
   type LatestCliVersionFetcher,
   fetchLatestCliVersion,
 } from '../../services/audit/cli-version';
-import type { MachineReachableResult } from '../../services/audit/machines-reachable';
 import type { ModuleVersionFetcher } from '../../services/audit/module-versions';
 import {
   loadPublicDnsEvidence,
@@ -57,8 +56,10 @@ import type { ServiceCredentialsResult } from '../../services/audit/services-cre
 import type { ServiceReachableResult } from '../../services/audit/services-reachable';
 import type { TerraformPlanRunner } from '../../services/audit/terraform-plan';
 import { getServiceCredentials, listContainerServices } from '../../services/container-service';
+import { probeDiskUsage } from '../../services/disk-probe';
 import { collectFirewallReach } from '../../services/firewall-reach';
 import { runAllHealthChecks } from '../../services/health-runner';
+import { collectJailExemptions } from '../../services/jail-exemptions';
 import { probeMachines } from '../../services/machine-probe';
 import { parseStoredConfigValue } from '../../services/module-config';
 import { createPublicDnsProbe, loadPublicDnsProbeSettings } from '../../services/public-dns-probe';
@@ -341,11 +342,22 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     }),
   );
 
-  // Machines-reachable: probe each pool machine. Shared with the monitor sweep
-  // (services/machine-probe.ts) — this block used to be a second copy of the
-  // same SSH logic, and both copies reported the local management box as
-  // unreachable because celilo does not hold an SSH key for itself.
-  const machineReachableResults: MachineReachableResult[] = await probeMachines();
+  // Machines-reachable and disk-space both SSH every system, so they run
+  // concurrently here rather than paying each other's latency. The machine
+  // probe is shared with the monitor sweep (services/machine-probe.ts) —
+  // this block used to be a second copy of the same SSH logic, and both
+  // copies reported the local management box as unreachable because celilo
+  // does not hold an SSH key for itself.
+  //
+  // The disk probe measures every system's root filesystem — the machine
+  // pool AND every provisioned instance, the systems celilo#1133 filled —
+  // in the same pre-computed measurement shape the disk_space monitor
+  // sweep consumes, so an audit finding and an alert page carry the same
+  // numbers.
+  const [machineReachableResults, diskUsageResults] = await Promise.all([
+    probeMachines(),
+    probeDiskUsage(db),
+  ]);
 
   const migrationsFolder = findMigrationsFolderSafe();
 
@@ -384,6 +396,7 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
         manifest: m.manifestData as ModuleManifest,
       })),
     },
+    jailExemptions: { exemptions: collectJailExemptions(db) },
     health: { results: healthResults },
     backups: { modules: installedBackupInfo },
     abandonedOperations: { records: loadAbandonedOperations(db) },
@@ -417,6 +430,7 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
       probe: createPublicDnsProbe(loadPublicDnsProbeSettings(db)),
       evidence: loadPublicDnsEvidence(db),
     },
+    diskSpace: { results: diskUsageResults },
     // Reads the record the poller already writes — this check never performs a
     // read of its own. One that did would drain the queue and eat the
     // acknowledgement it exists to protect (#541).