@celilo/cli 2.2.1 → 2.3.0

package/src/hooks/jail.test.ts

@@ -209,9 +209,13 @@ describe('the three policies', () => {
   });
 
   test("'required' turns an unavailable jail into a hard failure (task 4.5)", () => {
-    expect(() =>
-      planJailedSpawn(CMD, deriveMountSet(REQUEST), UNAVAILABLE, 'required', allPresent),
-    ).toThrow(/CELILO_HOOK_JAIL=required/);
+    expect(
+      () => planJailedSpawn(CMD, deriveMountSet(REQUEST), UNAVAILABLE, 'required', allPresent),
+      // Not /CELILO_HOOK_JAIL=required/. Since hook-jail-config-surface the
+      // policy can come from the stored `hooks.jail_policy` row or the
+      // default, so a message naming the variable names a source that may be
+      // unset.
+    ).toThrow(/hook jail policy is 'required'/);
   });
 
   test("'required' names the reason, so the operator can act on it", () => {
@@ -291,30 +295,42 @@ describe('jailPolicy reads the operator’s switch', () => {
 
 describe('resolveJailPolicy applies D2 precedence (hook-jail-config-surface)', () => {
   test('an env value set and non-empty wins over stored config', () => {
-    expect(resolveJailPolicy('required', 'off')).toEqual({ policy: 'required', source: 'env' });
+    expect(resolveJailPolicy('required', undefined, 'off')).toEqual({
+      policy: 'required',
+      source: 'env',
+    });
   });
 
   test('an EMPTY STRING env value counts as unset and falls through to config', () => {
     // jailPolicy() already treats '' as unset, so the resolver agrees rather
     // than inventing a second rule for what counts as set.
-    expect(resolveJailPolicy('', 'off')).toEqual({ policy: 'off', source: 'config' });
+    expect(resolveJailPolicy('', undefined, 'off')).toEqual({ policy: 'off', source: 'config' });
   });
 
   test('stored config wins when the env var is absent', () => {
-    expect(resolveJailPolicy(undefined, 'off')).toEqual({ policy: 'off', source: 'config' });
-    expect(resolveJailPolicy(undefined, 'required')).toEqual({
+    expect(resolveJailPolicy(undefined, undefined, 'off')).toEqual({
+      policy: 'off',
+      source: 'config',
+    });
+    expect(resolveJailPolicy(undefined, undefined, 'required')).toEqual({
       policy: 'required',
       source: 'config',
     });
   });
 
-  test('both absent resolves to off from the default (peba, ce-rez7)', () => {
-    expect(resolveJailPolicy(undefined, undefined)).toEqual({ policy: 'off', source: 'default' });
-    expect(resolveJailPolicy('', undefined)).toEqual({ policy: 'off', source: 'default' });
+  test('all absent resolves to off from the default (peba, ce-rez7)', () => {
+    expect(resolveJailPolicy(undefined, undefined, undefined)).toEqual({
+      policy: 'off',
+      source: 'default',
+    });
+    expect(resolveJailPolicy('', undefined, undefined)).toEqual({
+      policy: 'off',
+      source: 'default',
+    });
   });
 
   test('an explicit env auto still wins (peba, ce-rez7)', () => {
-    expect(resolveJailPolicy('auto', 'off')).toEqual({ policy: 'auto', source: 'env' });
+    expect(resolveJailPolicy('auto', undefined, 'off')).toEqual({ policy: 'auto', source: 'env' });
   });
 
   test('a stored empty jail_policy THROWS, it does not resolve to auto (peba, ce-8832)', () => {
@@ -322,8 +338,8 @@ describe('resolveJailPolicy applies D2 precedence (hook-jail-config-surface)', (
     // can only arrive via a restore from file or a hand edit to the DB — the
     // untrusted paths D3 exists to catch. It is outside the enum and fails
     // closed like any other bad stored value.
-    expect(() => resolveJailPolicy(undefined, '')).toThrow(/is not a hook jail policy/);
-    expect(() => resolveJailPolicy(undefined, '')).toThrow(/hooks\.jail_policy=''/);
+    expect(() => resolveJailPolicy(undefined, undefined, '')).toThrow(/is not a hook jail policy/);
+    expect(() => resolveJailPolicy(undefined, undefined, '')).toThrow(/hooks\.jail_policy=''/);
   });
 
   test('a typo in the STORED row is refused, not silently treated as auto (D3)', () => {
@@ -331,15 +347,87 @@ describe('resolveJailPolicy applies D2 precedence (hook-jail-config-surface)', (
     // foreign state, and a typo that silently meant `auto` reads as an armed
     // jail when nothing is armed. The config path is no laxer than the env
     // path.
-    expect(() => resolveJailPolicy(undefined, 'alwayssafe')).toThrow(/is not a hook jail policy/);
-    expect(() => resolveJailPolicy(undefined, 'alwayssafe')).toThrow(
+    expect(() => resolveJailPolicy(undefined, undefined, 'alwayssafe')).toThrow(
+      /is not a hook jail policy/,
+    );
+    expect(() => resolveJailPolicy(undefined, undefined, 'alwayssafe')).toThrow(
       /hooks\.jail_policy='alwayssafe'/,
     );
   });
 
   test('a typo in the env value is still refused (unchanged jailPolicy behaviour)', () => {
-    expect(() => resolveJailPolicy('requried', undefined)).toThrow(/is not a hook jail policy/);
-    expect(() => resolveJailPolicy('requried', 'off')).toThrow(/CELILO_HOOK_JAIL='requried'/);
+    expect(() => resolveJailPolicy('requried', undefined, undefined)).toThrow(
+      /is not a hook jail policy/,
+    );
+    expect(() => resolveJailPolicy('requried', undefined, 'off')).toThrow(
+      /CELILO_HOOK_JAIL='requried'/,
+    );
+  });
+});
+
+describe('resolveJailPolicy applies the four-step precedence (per-module-jail-policy task 1.3)', () => {
+  // Each boundary gets its own assertion, not just the ends: the chain is
+  // fixed and rendered, and a test that only pins (env, default) cannot tell
+  // a reordering of module and config apart from a correct one.
+
+  test('env beats the module row', () => {
+    expect(resolveJailPolicy('required', 'off', 'auto')).toEqual({
+      policy: 'required',
+      source: 'env',
+    });
+    expect(resolveJailPolicy('off', 'auto', 'auto')).toEqual({ policy: 'off', source: 'env' });
+  });
+
+  test('the module row beats system config', () => {
+    expect(resolveJailPolicy(undefined, 'off', 'auto')).toEqual({
+      policy: 'off',
+      source: 'module',
+    });
+    expect(resolveJailPolicy(undefined, 'required', 'off')).toEqual({
+      policy: 'required',
+      source: 'module',
+    });
+  });
+
+  test('system config beats the default', () => {
+    expect(resolveJailPolicy(undefined, undefined, 'auto')).toEqual({
+      policy: 'auto',
+      source: 'config',
+    });
+    expect(resolveJailPolicy(undefined, undefined, 'required')).toEqual({
+      policy: 'required',
+      source: 'config',
+    });
+  });
+
+  test('the default is off (peba, ce-rez7)', () => {
+    expect(resolveJailPolicy(undefined, undefined, undefined)).toEqual({
+      policy: 'off',
+      source: 'default',
+    });
+  });
+
+  test('an absent module row falls through to system config — absent means follow the system', () => {
+    // The everyday case: a fleet with no per-module rows behaves exactly as
+    // it does today, which is the spec's own operator guarantee.
+    expect(resolveJailPolicy(undefined, undefined, 'auto')).toEqual({
+      policy: 'auto',
+      source: 'config',
+    });
+  });
+
+  test('a bad stored per-module value THROWS rather than coercing (task 1.3)', () => {
+    // The same rule as the system key (peba, ce-8832): a restore or a hand
+    // edit is a trust boundary, and a typo that silently meant `off` would
+    // jail a module the operator exempted — or the reverse. The error names
+    // its source so a reader can tell which stored row is junk.
+    expect(() => resolveJailPolicy(undefined, 'alwayssafe', 'off')).toThrow(
+      /is not a hook jail policy/,
+    );
+    expect(() => resolveJailPolicy(undefined, 'alwayssafe', 'off')).toThrow(
+      /module's jail policy='alwayssafe'/,
+    );
+    expect(() => resolveJailPolicy(undefined, '', 'off')).toThrow(/is not a hook jail policy/);
   });
 });
 

package/src/hooks/jail.ts

@@ -100,7 +100,9 @@ export function autoJailDefers(availability: JailAvailability): boolean {
 }
 
 /**
- * What the operator asked for. `CELILO_HOOK_JAIL`, and the default is `auto`.
+ * What the operator asked for. `CELILO_HOOK_JAIL`, and the default is `off`
+ * (peba's ruling on ce-rez7; `resolveJailPolicy`'s doc comment below has the
+ * reversal trigger).
  *
  * `required` is D8's end state, reached as an explicit act once stage 2 has
  * been proven on a host: an unavailable jail becomes a hard failure rather
@@ -433,21 +435,37 @@ export function jailPolicy(): JailPolicy {
 }
 
 /** Where the effective jail policy came from. Rendered by `system doctor` (D4). */
-export type JailPolicySource = 'env' | 'config' | 'default';
+export type JailPolicySource = 'env' | 'module' | 'config' | 'default';
+
+/** How much jailing a policy does. Lower is weaker (per-module-jail-policy). */
+export const POLICY_STRENGTH: Record<JailPolicy, number> = { off: 0, auto: 1, required: 2 };
+
+/**
+ * Whether the module's own policy jails LESS than the system's would — the
+ * definition of an exemption (per-module-jail-policy task 3.1-3.3).
+ *
+ * Shared by `module jail`'s weakening interview, `module list`'s marker,
+ * `system doctor`'s count and `system audit`'s category, so the four
+ * surfaces cannot disagree about what an exemption is.
+ */
+export function isWeakerJailPolicy(modulePolicy: JailPolicy, systemPolicy: JailPolicy): boolean {
+  return POLICY_STRENGTH[modulePolicy] < POLICY_STRENGTH[systemPolicy];
+}
 
 /**
- * Apply D2's precedence to the two sources: env wins, then stored config,
- * then the default, which is `off` (peba's ruling on ce-rez7; see
- * openspec/changes/hook-jail-config-surface/design.md for the reversal
- * trigger).
+ * Apply the precedence to the four sources (per-module-jail-policy task 1.2):
+ * env wins, then the module's own recorded policy, then stored system
+ * config, then the default, which is `off` (peba's rulings on ce-rez7 and
+ * ce-8832; see openspec/changes/hook-jail-config-surface/design.md and
+ * openspec/changes/per-module-jail-policy/ for the fixed chain).
  *
  * Pure, so both consumers (executor.ts and system-doctor.ts) can fetch the
- * stored row themselves and stay testable without a database.
+ * stored rows themselves and stay testable without a database.
  *
  * The empty-string env value is treated as unset, matching `jailPolicy()`'s
  * own handling — one rule for "what counts as set", not a second one here.
  *
- * The config path is deliberately stricter than the env path: a stored
+ * The stored paths are deliberately stricter than the env path: a stored
  * empty string THROWS (peba's ruling on ce-8832). The set-time pattern
  * `^(auto|off|required)$` rejects `''`, so a stored one can only arrive via
  * a restore from file or a hand edit to the DB — exactly the untrusted
@@ -456,9 +474,15 @@ export type JailPolicySource = 'env' | 'config' | 'default';
  * closed is the whole point. An empty CELILO_HOOK_JAIL stays "not set",
  * because `jailPolicy()` relies on that and slice 1's safety rests on the
  * two resolvers agreeing.
+ *
+ * The module row follows the same throw rule as the system key (task 1.3).
+ * `undefined` is the everyday case — no row, follow the system — and a row
+ * keyed to a module that was removed is impossible by schema: the FK
+ * cascades the delete.
  */
 export function resolveJailPolicy(
   envValue: string | undefined,
+  moduleValue: string | undefined,
   configValue: string | undefined,
 ): { policy: JailPolicy; source: JailPolicySource } {
   if (envValue !== undefined && envValue !== '') {
@@ -469,6 +493,14 @@ export function resolveJailPolicy(
       `CELILO_HOOK_JAIL='${envValue}' is not a hook jail policy. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
     );
   }
+  if (moduleValue !== undefined) {
+    if (moduleValue === 'auto' || moduleValue === 'off' || moduleValue === 'required') {
+      return { policy: moduleValue, source: 'module' };
+    }
+    throw new Error(
+      `the module's jail policy='${moduleValue}' is not a hook jail policy. Use 'auto' (jail when a backend is available), 'required' (an unavailable jail is a hard failure), or 'off'.`,
+    );
+  }
   if (configValue !== undefined) {
     if (configValue === 'auto' || configValue === 'off' || configValue === 'required') {
       return { policy: configValue, source: 'config' };
@@ -620,9 +652,14 @@ function realpathOrSelf(path: string): string {
  * Why an `off` policy runs unjailed, shared with `celilo system doctor` (task
  * 4.6) so the sentence the operator reads there is the sentence the record
  * carries.
+ *
+ * It names no source. Since hook-jail-config-surface there are three (the
+ * environment variable, the stored `hooks.jail_policy` row, and the `off`
+ * default), and this sentence is rendered for all of them. The doctor prints
+ * the source on its own line above this one; the record carries it as state.
  */
 export const JAIL_OFF_REASON =
-  'CELILO_HOOK_JAIL=off: the operator switched the hook jail off on this host.';
+  "The hook jail policy is 'off', so hooks run unjailed on this host. Set hooks.jail_policy to 'auto' or 'required' to jail them.";
 
 export function planJailedSpawn(
   cmd: readonly string[],
@@ -647,7 +684,7 @@ export function planJailedSpawn(
       : 'This invocation has no module tree to jail, so there is no mount set to enforce.';
     if (policy === 'required') {
       throw new Error(
-        `CELILO_HOOK_JAIL=required and no hook jail is available. ${reason ?? ''}`.trim(),
+        `The hook jail policy is 'required' and no hook jail is available. ${reason ?? ''}`.trim(),
       );
     }
     return { cmd, mode: 'unjailed', backend: availability.backend, reason, skipped: [] };

package/src/manifest/contracts/v1.ts

@@ -173,6 +173,19 @@ export const V1_HOOKS: ContractHooks = {
        * mount-set derivation walking the declared inputs could not see it.
        */
       system_state_root: { required: false, path: { access: 'read' } },
+      /**
+       * The management-host inventory as a JSON array, staged by
+       * `backup-create.ts` from `listMachines()` under the same
+       * cross_module_read privilege as `system_state_root`. Not a path: the
+       * hook reads the value, not a file, so it carries no mount-set entry.
+       *
+       * It replaces on_backup's `celilo machine list --json` spawn, which the
+       * hook jail kills (no celilo binary, celilo#1225) and which never
+       * actually produced JSON before that — the CLI printed its human report,
+       * the hook's JSON.parse failed, and the catch wrote [] into every
+       * envelope (ce-y0we).
+       */
+      machine_pool: { required: false },
     },
     outputs: {
       artifact_count: { required: true },

package/src/policy/module-script-scan.ts

@@ -82,28 +82,36 @@ export const SWALLOWED_REFUSAL_RULE = 'swallowed framework refusal';
  */
 const CLI_SPAWN_RE =
   /\b(?:execSync|execFileSync|execFile|exec|spawnSync|spawn)\s*\(\s*(?:['"`]\s*celilo(?=\s|['"`])|`[^`]*\bcelilo(?=\s|`))/;
+
+/**
+ * The spawn rule runs against the WHOLE FILE, not one line at a time. The
+ * per-line pass above could not see a call whose argv wrapped onto the next
+ * line — `execFileSync(\n  'celilo', …` — and that blind spot was live:
+ * celilo-registry setup.ts carried a four-line spawn and iptables
+ * firewall-functions.ts three more, all scanning clean while the gate was
+ * green (found by ce-y0we's reach check on 2026-09-09). The regex itself
+ * needs no change — `\s*` already crosses newlines, and `[^\`]*` never
+ * matches a backtick so a template cannot swallow the rest of the file — it
+ * just has to be applied to text wider than a line. Line numbers come from
+ * the match index, so reports still name the line an author fixes.
+ */
+const CLI_SPAWN_BLOCK_RE = new RegExp(CLI_SPAWN_RE.source, 'g');
+
+/** Same wording the rule carried when it ran per line; moved with the pass. */
+const CLI_SPAWN_HINT =
+  'A jailed hook has no celilo binary and no shell, so this dies with ' +
+  '"Executable not found in $PATH" (celilo#1225). Replace the spawn with an ' +
+  'injected capability — context.secrets/context.config for self-config and ' +
+  'self-secrets (openspec/changes/hook-owned-state) — or move the operation ' +
+  'into the framework the way celilo-mgmt on_install did (5e0e624d).';
+
 const FRAMEWORK_CALL_RE = new RegExp(`${CLI_SPAWN_RE.source}|\\brunCelilo\\s*\\(`);
 
 const PATTERN_RULES: Array<{ rule: string; re: RegExp; hint: string }> = [
-  {
-    rule: JAILED_CLI_SPAWN_RULE,
-    // Same regex as CLI_SPAWN_RE below — one definition of "reaches the
-    // framework", used by both rules that key on it. Matches the CLI as
-    // argv[0] of a spawn-family call ('celilo' / "celilo"), or inside a shell
-    // string passed to one, where celilo is followed by a word (a subcommand)
-    // or the closing quote — so `docker exec celilo-mgr …`, a `celilo.db` file
-    // name, and prose that merely names the CLI do not fire. What it
-    // deliberately cannot see: a binary path resolved into a variable, or a
-    // spawn reached through an indirection. Same honesty class as the
-    // namespace rule — a lint, not a boundary.
-    re: CLI_SPAWN_RE,
-    hint:
-      'A jailed hook has no celilo binary and no shell, so this dies with ' +
-      '"Executable not found in $PATH" (celilo#1225). Replace the spawn with an ' +
-      'injected capability — context.secrets/context.config for self-config and ' +
-      'self-secrets (openspec/changes/hook-owned-state) — or move the operation ' +
-      'into the framework the way celilo-mgmt on_install did (5e0e624d).',
-  },
+  // NOTE: the jailed-CLI-spawn rule is NOT in this array — it runs in its own
+  // whole-file pass in scanModuleScriptSource (CLI_SPAWN_BLOCK_RE), because a
+  // per-line match missed every spawn whose argv wrapped. Everything else
+  // stays per-line.
   {
     rule: 'raw ssh invocation (StrictHostKeyChecking)',
     re: /StrictHostKeyChecking/,
@@ -200,6 +208,20 @@ export function scanModuleScriptSource(file: string, source: string): ScanViolat
   const violations: ScanViolation[] = [];
   const lines = source.split('\n');
 
+  // The jailed-CLI-spawn pass: whole-file, so a spawn whose argv wraps onto
+  // the next line is still seen (see CLI_SPAWN_BLOCK_RE for the blind spot
+  // that motivated this). Reported on the line the CALL starts, because that
+  // is the site an author fixes.
+  CLI_SPAWN_BLOCK_RE.lastIndex = 0;
+  for (let m = CLI_SPAWN_BLOCK_RE.exec(source); m !== null; m = CLI_SPAWN_BLOCK_RE.exec(source)) {
+    violations.push({
+      file,
+      line: source.slice(0, m.index).split('\n').length,
+      rule: JAILED_CLI_SPAWN_RULE,
+      hint: CLI_SPAWN_HINT,
+    });
+  }
+
   lines.forEach((text, i) => {
     for (const { rule, re, hint } of PATTERN_RULES) {
       if (re.test(text)) violations.push({ file, line: i + 1, rule, hint });
@@ -337,51 +359,19 @@ export interface PolicyDebtEntry {
  * the test goes red, and the entry must be deleted in the same change.
  */
 export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
-  {
-    module: 'celilo-mgmt',
-    file: 'scripts/on_backup.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 / survey class G: machine list becomes a machine-pool read capability',
-  },
   {
     module: 'dnsmasq-dhcp',
     file: 'scripts/dhcp-server-functions.ts',
     matches: 1,
     reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'forgejo',
-    file: 'scripts/on-consumer-removed.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (runner_registrations, Group B3)',
+      'capability provider, no hook entry imports it — ce-mqay (jail does not constrain it; conversion is dedup, not breakage)',
   },
   {
-    module: 'forgejo',
-    file: 'scripts/setup.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (secret set)',
-  },
-  {
-    module: 'forgejo',
-    file: 'scripts/source-forge-functions.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
-  },
-  {
-    module: 'generic-cpanel-hosting-provider',
-    file: 'scripts/on-consumer-removed.ts',
-    matches: 1,
-    reason: 'hook-owned-state 5.5 (publications, Group B4)',
-  },
-  {
-    module: 'generic-cpanel-hosting-provider',
-    file: 'scripts/publish-functions.ts',
-    matches: 1,
+    module: 'iptables',
+    file: 'scripts/firewall-functions.ts',
+    matches: 3,
     reason:
-      'hook-owned-state 5.5 shape (self-config write); not in its 10-site table — reconcile there',
+      'ce-mqay: capability provider, no hook entry imports it. Two config-set writes and one events emit. INVISIBLE to the scan until ce-y0we taught it continuation lines (2026-09-09) — these three were live spawns the green gate could not see',
   },
 ];
 
@@ -393,19 +383,13 @@ export const JAILED_CLI_SPAWN_DEBT: readonly PolicyDebtEntry[] = [
  * same guarded rot: when a site converts, the count drops, the debt test goes
  * red, and the entry must be deleted in the same change.
  *
- * Converted on 2026-09-07 by ce-pvii: knot-unbound-internal/scripts/on-install.ts
- * dropped its last swallow (the runCelilo wrapper), so the rule fires on
- * exactly these two sites and nothing else in the tree.
+ * EMPTY as of ce-y0we (2026-09-09): knot-unbound-internal's on-install dropped
+ * its last swallow on 2026-09-07 (ce-pvii), wireguard's health-check converted
+ * the same evening (01575380), and celilo-mgmt's on_backup machine-pool read
+ * retired the last entry. A NEW swallowed refusal must never land here — it
+ * gets fixed, not tracked.
  */
-export const SWALLOWED_REFUSAL_DEBT: readonly PolicyDebtEntry[] = [
-  {
-    module: 'celilo-mgmt',
-    file: 'scripts/on_backup.ts',
-    matches: 1,
-    reason:
-      'hook-owned-state 5.5 / survey class G: machine list becomes a typed-absent machine-pool read',
-  },
-];
+export const SWALLOWED_REFUSAL_DEBT: readonly PolicyDebtEntry[] = [];
 
 /**
  * The files inside `@celilo/capabilities` that implement the remote-exec

package/src/policy/no-hand-built-ssh.test.ts

@@ -85,7 +85,11 @@ describe('recurrence gate: the jailed-CLI-spawn debt list is honest', () => {
   });
 
   test('the debt list is non-trivial (the guard actually reached the entries)', () => {
-    expect(JAILED_CLI_SPAWN_DEBT.length).toBeGreaterThan(5);
+    // Was >5 while the list still carried the hook-owned-state 5.5 batch. The
+    // conversions retire entries faster than new debt arrives (ce-y0we), so
+    // the floor is now "at least one tracked site" — enough to prove the test
+    // reached the list without pinning the retirement schedule.
+    expect(JAILED_CLI_SPAWN_DEBT.length).toBeGreaterThan(0);
   });
 });
 

package/src/policy/no-swallowed-refusal.test.ts

@@ -212,9 +212,9 @@ describe('recurrence gate: a hook does not swallow a refused framework call', ()
     }
   });
 
-  test('today’s tree: the remaining known sites are flagged, and nothing else is', () => {
+  test('today’s tree: no swallowed refusals anywhere, and the scan still reaches every module', () => {
     // Raw scan, deliberately NOT scanModuleDirectory: the debt list below
-    // exempts these same files so the merged gate stays green while
+    // exempts the same files so the merged gate stays green while
     // hook-owned-state converts them, and this assertion has to outlive that
     // exemption to prove the rule still reaches them.
     const violations = moduleDirs().flatMap((d) =>
@@ -225,13 +225,11 @@ describe('recurrence gate: a hook does not swallow a refused framework call', ()
       ),
     );
     const sites = violations.map((v) => v.file.replace(`${repoRoot()}/`, '')).sort();
-    // Pinned to the exact sites from e2e-suite-recovery task 4.2, as measured
-    // on 2026-09-07 at on_backup.ts:52 (a third, on-install.ts:69, converted
-    // by ce-pvii the same day, and wireguard's health-check.ts converted by
-    // 01575380 the same evening). A converted site drops out and the debt
-    // entry must go; a NEW site appearing here is the next instance this scan
-    // exists to stop.
-    expect(sites).toEqual(['modules/celilo-mgmt/scripts/on_backup.ts']);
+    // Empty since ce-y0we (2026-09-09): on_backup.ts:52 was the last site —
+    // its machine-pool read is staged input now — and the two before it
+    // converted on 2026-09-07 (ce-pvii and 01575380). A NEW site appearing
+    // here is the next instance this scan exists to stop.
+    expect(sites, `Module script policy violations:\n${formatViolations(violations)}`).toEqual([]);
   });
 });
 
@@ -255,10 +253,12 @@ describe('recurrence gate: the swallow debt list is honest', () => {
     }
   });
 
-  test('the debt list is non-trivial (the guard actually reached the entries)', () => {
-    // The list held three entries until ce-pvii converted the on-install.ts
-    // entry and 01575380 converted wireguard's health-check (both
-    // 2026-09-07); one remains, so the guard still proves engagement.
-    expect(SWALLOWED_REFUSAL_DEBT.length).toBeGreaterThan(0);
+  test('the debt list is retired (empty), and this test pins that fact', () => {
+    // The list held three entries when the gate landed; ce-pvii and 01575380
+    // converted two on 2026-09-07 and ce-y0we retired the last (on_backup's
+    // machine-pool read) on 2026-09-09. Kept as an explicit pin so a future
+    // entry has to be justified against this sentence: a swallowed refusal is
+    // a defect to fix, never debt to track.
+    expect(SWALLOWED_REFUSAL_DEBT).toEqual([]);
   });
 });

package/src/registry/client.test.ts

@@ -48,14 +48,14 @@ describe('RegistryClient constructor', () => {
 
   afterEach(() => {
     if (origEnv === undefined) {
-      process.env.CELILO_REGISTRY_URL = undefined;
+      delete process.env.CELILO_REGISTRY_URL;
     } else {
       process.env.CELILO_REGISTRY_URL = origEnv;
     }
   });
 
   test('uses DEFAULT_REGISTRY when no arg and no env var', () => {
-    process.env.CELILO_REGISTRY_URL = undefined;
+    delete process.env.CELILO_REGISTRY_URL;
     const client = new RegistryClient();
     expect(client.baseUrl).toBe(DEFAULT_REGISTRY);
   });

package/src/secrets/storage.test.ts

@@ -36,7 +36,7 @@ describe('secret storage', () => {
   afterEach(() => {
     // Cleanup
     rmSync(testDir, { recursive: true, force: true });
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   test('stores and retrieves system secret', async () => {

package/src/services/alerting/keys.test.ts

@@ -116,6 +116,10 @@ describe('severityForItemStatus', () => {
     expect(severityForItemStatus('fail', 'critical')).toBe('critical');
     expect(severityForItemStatus('fail', 'warning')).toBe('warning');
   });
+
+  test('skip produces no alert — a check that could not run is not a failure', () => {
+    expect(severityForItemStatus('skip', 'critical')).toBeNull();
+  });
 });
 
 describe('failingKeysFromHealthItems', () => {

package/src/services/alerting/keys.ts

@@ -134,14 +134,24 @@ export function parentModuleKey(key: string): string | null {
  * and never pages. That gives module authors somewhere to put "cert expires in
  * 20 days" without anyone having to decide whether it is a 3am problem.
  *
+ * `skip` produces no alert either: a check that could not perform its probe
+ * is not a failure. Note the honest cost — a previously-failing key whose
+ * item now reports skip leaves this run's failing set, so the reconciler
+ * reads "recovered" off a run that measured nothing. That is the same hazard
+ * class design D5 handles at run level (a run that could not execute is the
+ * caller's branch); there is no per-item sticky-key mechanism here, so a
+ * module whose credential disappeared needs the audit's `unmeasured` finding
+ * to be seen (celilo#1326).
+ *
  * See design D6.
  */
 export function severityForItemStatus(
-  itemStatus: 'pass' | 'warn' | 'fail',
+  itemStatus: 'pass' | 'warn' | 'fail' | 'skip',
   monitorSeverity: AlertSeverity,
 ): AlertSeverity | null {
   if (itemStatus === 'pass') return null;
   if (itemStatus === 'warn') return 'warning';
+  if (itemStatus === 'skip') return null;
   return monitorSeverity;
 }
 
@@ -155,7 +165,7 @@ export interface FailingKey {
 
 export interface HealthCheckItemLike {
   name: string;
-  status: 'pass' | 'warn' | 'fail';
+  status: 'pass' | 'warn' | 'fail' | 'skip';
   message: string;
   details?: string;
 }