@celilo/cli 2.2.1 → 3.0.0

package/src/services/module-deploy.ts

@@ -4,7 +4,7 @@
  * Coordinates full module deployment workflow across all phases
  */
 
-import { rmSync } from 'node:fs';
+import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ProgressDisplay } from '@celilo/cli-display';
 import { and, eq } from 'drizzle-orm';
@@ -337,6 +337,61 @@ async function backfillArrivedProvider(moduleId: string, db: DbClient): Promise<
  * alerting, etc. — can react. Bus emit failures are best-effort and
  * never affect the deploy outcome.
  */
+/**
+ * Files under `generated/terraform/` that outlive the deploy.
+ *
+ * D4 (control-plane-stops-building-modules) deletes `generated/` because it
+ * holds RENDERED templates and secrets — a tree nothing can validate and what a
+ * later deploy would wrongly ship. Terraform state is neither. It is the record
+ * of what celilo actually BUILT, and `templates/generator.ts` calls it
+ * "celilo's authoritative record of placement (ISS-0090)".
+ *
+ * Deleting it meant the next deploy started from empty state, failed to create
+ * a container that already existed, auto-imported it, and planned a REPLACE —
+ * destroying the container it was asked to converge (celilo#1374, which
+ * destroyed signal's LXC and its signal-cli device identity).
+ *
+ * `.terraform/` is NOT preserved: it is the provider binary cache, ~19 MB per
+ * provider, rebuilt by `terraform init`. `cross-module-read.ts` excludes it from
+ * the backup envelope for the same reason.
+ */
+export const PRESERVED_GENERATED_FILES = [
+  'terraform.tfstate',
+  'terraform.tfstate.backup',
+  '.terraform.lock.hcl',
+];
+
+/** True for the paths, relative to `generated/`, that survive the cleanup. */
+export function isPreservedGeneratedPath(relativePath: string): boolean {
+  const [dir, file, ...rest] = relativePath.split('/');
+  if (dir !== 'terraform' || rest.length > 0) return false;
+  return file !== undefined && PRESERVED_GENERATED_FILES.includes(file);
+}
+
+/**
+ * Delete the rendered project but keep terraform's record of what exists.
+ * Absent `generated/` is not an error — a deploy that failed early never made
+ * one.
+ */
+export function pruneGeneratedProject(generatedPath: string): void {
+  if (!existsSync(generatedPath)) return;
+
+  for (const entry of readdirSync(generatedPath, { withFileTypes: true })) {
+    if (entry.name !== 'terraform') {
+      rmSync(join(generatedPath, entry.name), { recursive: true, force: true });
+    }
+  }
+
+  const terraformDir = join(generatedPath, 'terraform');
+  if (!existsSync(terraformDir)) return;
+
+  for (const entry of readdirSync(terraformDir, { withFileTypes: true })) {
+    if (!isPreservedGeneratedPath(`terraform/${entry.name}`)) {
+      rmSync(join(terraformDir, entry.name), { recursive: true, force: true });
+    }
+  }
+}
+
 export async function deployModule(
   moduleId: string,
   db: DbClient,
@@ -392,8 +447,10 @@ export async function deployModule(
       if (deployed) {
         const generatedPath = `${deployed.sourcePath}/generated`;
         try {
-          rmSync(generatedPath, { recursive: true, force: true });
-          log.info(`Removed generated/ for '${moduleId}' (ephemeral by design; --keep retains it)`);
+          pruneGeneratedProject(generatedPath);
+          log.info(
+            `Removed generated/ for '${moduleId}' (terraform state preserved; --keep retains all)`,
+          );
         } catch (cleanupError) {
           const msg = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
           log.warn(`Failed to remove generated/ for '${moduleId}': ${msg}`);
@@ -907,48 +964,10 @@ async function deployModuleImpl(
           };
         }
 
-        // Store hook outputs as secrets (e.g., refresh_token from OAuth flow)
-        if (Object.keys(hookResult.outputs).length > 0) {
-          const { secrets: secretsTable } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          const { and: andOp, eq: eqOp } = await import('drizzle-orm');
-          for (const [key, value] of Object.entries(hookResult.outputs)) {
-            if (typeof value === 'string') {
-              const masterKeyForOutputs = await getOrCreateMasterKey();
-              const encrypted = encryptSecret(value, masterKeyForOutputs);
-
-              // Check if secret already exists (no unique constraint on module_id+name)
-              const existing = db
-                .select()
-                .from(secretsTable)
-                .where(andOp(eqOp(secretsTable.moduleId, moduleId), eqOp(secretsTable.name, key)))
-                .get();
-
-              if (existing) {
-                db.update(secretsTable)
-                  .set({
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                    updatedAt: new Date(),
-                  })
-                  .where(eqOp(secretsTable.id, existing.id))
-                  .run();
-              } else {
-                db.insert(secretsTable)
-                  .values({
-                    moduleId,
-                    name: key,
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                  })
-                  .run();
-              }
-              log.success(`Stored hook output: ${key}`);
-            }
-          }
-        }
+        // Hook return values are no longer persisted (hook-owned-state D5):
+        // a hook that needs to persist state does so explicitly through the
+        // `context.config` / `context.secrets` accessors inside its own
+        // process. Nothing here sweeps `hookResult.outputs` into secrets.
 
         gauge.stop(true);
       } catch (error) {
@@ -1048,8 +1067,13 @@ async function deployModuleImpl(
         }
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED. A successful deploy ends any recorded
+      // failure: leaving a stale errorMessage would print `Error:` beside a
+      // healthy state in `module list` / `module status` (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks for config-only modules too
       if (manifest.hooks?.health_check) {
@@ -1347,45 +1371,11 @@ async function deployModuleImpl(
           };
         }
 
-        // Store hook outputs as secrets on the PROVIDER module
-        if (Object.keys(hookResult.outputs).length > 0) {
-          const { secrets: st } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          for (const [key, value] of Object.entries(hookResult.outputs)) {
-            if (typeof value === 'string') {
-              const mk = await getOrCreateMasterKey();
-              const encrypted = encryptSecret(value, mk);
-              const existing = db
-                .select()
-                .from(st)
-                .where(and(eq(st.moduleId, capRecord.moduleId), eq(st.name, key)))
-                .get();
-
-              if (existing) {
-                db.update(st)
-                  .set({
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                    updatedAt: new Date(),
-                  })
-                  .where(eq(st.id, existing.id))
-                  .run();
-              } else {
-                db.insert(st)
-                  .values({
-                    moduleId: capRecord.moduleId,
-                    name: key,
-                    encryptedValue: encrypted.encryptedValue,
-                    iv: encrypted.iv,
-                    authTag: encrypted.authTag,
-                  })
-                  .run();
-              }
-              log.success(`Stored ${capRecord.moduleId} hook output: ${key}`);
-            }
-          }
-        }
+        // The return-value channel is gone (hook-owned-state D5/D3): hook
+        // outputs are no longer persisted anywhere. A provider secret the
+        // framework itself must record goes through the named
+        // `recordProviderSecret` path (secrets/storage.ts) — never through a
+        // hook return value.
 
         gauge.stop(true);
       }
@@ -1673,51 +1663,16 @@ async function deployModuleImpl(
           };
         }
 
-        // Persist on_install string outputs as secrets on this module — same
-        // as the validate_config / container_created paths above. caddy relies
-        // on this to publish its firewall external IP (`public_ip`) so
-        // public_web.register_route can point a new hostname's public A record
-        // at it (M1 / #328).
-        if (Object.keys(installResult.outputs).length > 0) {
-          const { secrets: st } = await import('../db/schema');
-          const { encryptSecret } = await import('../secrets/encryption');
-          const mk = await getOrCreateMasterKey();
-          for (const [key, value] of Object.entries(installResult.outputs)) {
-            if (typeof value !== 'string') continue;
-            const encrypted = encryptSecret(value, mk);
-            const existing = db
-              .select()
-              .from(st)
-              .where(and(eq(st.moduleId, moduleId), eq(st.name, key)))
-              .get();
-            if (existing) {
-              db.update(st)
-                .set({
-                  encryptedValue: encrypted.encryptedValue,
-                  iv: encrypted.iv,
-                  authTag: encrypted.authTag,
-                  updatedAt: new Date(),
-                })
-                .where(eq(st.id, existing.id))
-                .run();
-            } else {
-              db.insert(st)
-                .values({
-                  moduleId,
-                  name: key,
-                  encryptedValue: encrypted.encryptedValue,
-                  iv: encrypted.iv,
-                  authTag: encrypted.authTag,
-                })
-                .run();
-            }
-            log.success(`Stored hook output: ${key}`);
-          }
-        }
+        // Hook return values are no longer persisted (hook-owned-state D5).
+        // caddy's `public_ip` moved to `context.config.set` + a config read
+        // (task 5.1); no other hook may rely on its return reaching the store.
       }
 
-      // Transition to INSTALLED
-      db.update(modules).set({ state: 'INSTALLED' }).where(eq(modules.id, moduleId)).run();
+      // Transition to INSTALLED; see the first transition for errorMessage (celilo#1363).
+      db.update(modules)
+        .set({ state: 'INSTALLED', errorMessage: null })
+        .where(eq(modules.id, moduleId))
+        .run();
 
       // Run health checks after successful deployment
       if (manifest.hooks?.health_check) {

package/src/services/module-subscriptions.test.ts

@@ -155,7 +155,7 @@ describe('register / unregister roundtrip', () => {
     process.env.EVENT_BUS_DB = dbPath;
   });
   afterEach(() => {
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -343,7 +343,7 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.EVENT_BUS_DB;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/module-types-drift.test.ts

@@ -8,7 +8,7 @@
  * committed types file is not regenerated, this test fails.
  *
  * Scope: `modules/<id>/manifest.yml` at the repo root. Archived
- * modules (`modules/archive/**`) and scratch extract dirs
+ * modules (`modules/__archive__/**`) and scratch extract dirs
  * (`modules/.tmp-*`) are excluded — they are not active modules.
  */
 

package/src/services/module-validator/capability-versions.test.ts

@@ -14,11 +14,15 @@ describe('validateCapabilityVersions', () => {
   });
 
   test('no errors when provides matches the runtime registry exactly', () => {
+    // Read from the registry, not pinned to a literal (see the comment on the
+    // "differs from runtime" test below — the registry moves, the test is
+    // about matching it).
+    const runtime = CAPABILITY_CONTRACT_VERSIONS.public_web;
     expect(
       validateCapabilityVersions({
         id: 'caddy',
         version: '3.0.0',
-        provides: { capabilities: [{ name: 'public_web', version: '3.0.0' }] },
+        provides: { capabilities: [{ name: 'public_web', version: runtime }] },
       }),
     ).toEqual([]);
   });
@@ -40,10 +44,17 @@ describe('validateCapabilityVersions', () => {
   });
 
   test('error when provides[X].version is newer than runtime', () => {
+    // One minor above the registry is newer without being a different major,
+    // which is what this case tests. Computed from the registry so the test
+    // stays a behaviour test as the registry moves.
+    const [maj, min, pat] = CAPABILITY_CONTRACT_VERSIONS.public_web
+      .split('.')
+      .map((n) => Number.parseInt(n, 10));
+    const tooNew = `${maj}.${(min ?? 0) + 1}.${pat ?? 0}`;
     const errors = validateCapabilityVersions({
       id: 'caddy',
       version: '4.0.0',
-      provides: { capabilities: [{ name: 'public_web', version: '4.0.0' }] },
+      provides: { capabilities: [{ name: 'public_web', version: tooNew }] },
     });
     expect(errors).toHaveLength(1);
     expect(errors[0]).toContain('provides[public_web]');

package/src/services/network-discovery.test.ts

@@ -15,8 +15,9 @@
 import { beforeEach, describe, expect, test } from 'bun:test';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { modules, systemConfig } from '../db/schema';
 import { setupTestDatabase } from '../test-utils/database';
+import { CONTROL_PLANE_MODULE_ID, upsertDeployedSystem } from './deployed-systems';
 import {
   discoverAndRecordNetwork,
   discoveredNetworkKeys,
@@ -102,6 +103,33 @@ describe('discoveredNetworkKeys (issue #300 redeploy idempotency)', () => {
     });
   });
 
+  test('first install with control plane in secure-mgmt records there (celilo#1356)', () => {
+    // The default topology (ce-8mxz) puts celilo-mgr on secure-mgmt, so a fresh
+    // segmented bootstrap must not file the control-plane subnet under
+    // `network.internal.*` — celilo would otherwise be blind to its own
+    // internal zone.
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'secure-mgmt' })).toEqual({
+      'network.secure-mgmt.subnet': '192.168.1.0/24',
+      'network.secure-mgmt.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install with control plane in internal is unchanged', () => {
+    expect(discoveredNetworkKeys(internal, false, { controlPlaneZone: 'internal' })).toEqual({
+      'network.internal.subnet': '192.168.1.0/24',
+      'network.internal.gateway': '192.168.1.1',
+    });
+  });
+
+  test('first install never clobbers an already-set control-plane zone value', () => {
+    expect(
+      discoveredNetworkKeys(internal, false, {
+        controlPlaneZone: 'secure-mgmt',
+        secureMgmtAlreadySet: true,
+      }),
+    ).toEqual({});
+  });
+
   test('preserves an already-set subnet on redeploy (no override)', () => {
     // The regression: a redeploy on a box off the internal network discovers the
     // WRONG subnet — it must not clobber the operator's value.
@@ -165,6 +193,41 @@ describe('discoverAndRecordNetwork', () => {
     expect(read('network.internal.gateway')).toBe('10.31.7.1');
   });
 
+  test('first install for a control plane deployed in secure-mgmt records secure-mgmt (celilo#1356)', () => {
+    // Seed the module_systems row the deploy pipeline writes before
+    // bootstrapControlPlane runs, placing celilo-mgmt in secure-mgmt.
+    db.insert(modules)
+      .values({
+        id: CONTROL_PLANE_MODULE_ID,
+        name: 'Celilo Management Server',
+        version: '0.9.0',
+        manifestData: {},
+        sourcePath: '/tmp/modules/celilo-mgmt',
+      })
+      .run();
+    upsertDeployedSystem(db, CONTROL_PLANE_MODULE_ID, {
+      name: 'main',
+      hostname: 'celilo-mgr',
+      ipv4Address: '10.226.120.10',
+      zone: 'secure-mgmt',
+      infraType: 'machine',
+      machineId: null,
+      serviceId: null,
+      vmid: null,
+    });
+
+    const result = discoverAndRecordNetwork(db, () =>
+      ipRouteFor('10.226.120.0', '10.226.120.1', '10.226.120.10'),
+    );
+
+    expect(result.applied).toEqual([
+      'network.secure-mgmt.subnet = 10.226.120.0/24',
+      'network.secure-mgmt.gateway = 10.226.120.1',
+    ]);
+    expect(read('network.internal.subnet')).toBeUndefined();
+    expect(read('network.secure-mgmt.subnet')).toBe('10.226.120.0/24');
+  });
+
   test('a redeploy on the same box changes nothing and says so', () => {
     const routes = () => ipRouteFor('10.31.7.0', '10.31.7.1', '10.31.7.20');
     discoverAndRecordNetwork(db, routes);

package/src/services/network-discovery.ts

@@ -24,7 +24,8 @@
 import { execFileSync } from 'node:child_process';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../db/client';
-import { systemConfig } from '../db/schema';
+import { type NetworkZone, systemConfig } from '../db/schema';
+import { CONTROL_PLANE_MODULE_ID, asZone, getModuleSystems } from './deployed-systems';
 
 export interface DiscoveredNetwork {
   subnet: string;
@@ -61,7 +62,14 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
  *    LAN, so what it discovered IS `internal`. First install records it there.
  *  - Segmented deployment: the box sits on a dedicated control-plane network.
  *    `internal` is then someone else's subnet — the semi-trusted LAN — and the
- *    discovered value belongs under `secure-mgmt`.
+ *    discovered value belongs under the control plane's own zone (`secure-mgmt`
+ *    in the default topology, celilo#1356).
+ *
+ * On FIRST INSTALL the zone is decided the same way the rest of celilo decides
+ * it: from where the control plane actually landed. `discoverAndRecordNetwork`
+ * reads `celilo-mgmt`'s deployed-system row and passes that zone in as
+ * `opts.controlPlaneZone`; with no row recorded yet the fallback stays
+ * `internal`, the pre-#1356 behaviour.
  *
  * Issue #300 spotted the second case as "discovery returns the WRONG subnet" and
  * mitigated it by DISCARDING the value whenever `internal` was already set. That
@@ -76,14 +84,21 @@ export function parseInternalNetwork(ipRouteOutput: string): DiscoveredNetwork |
 export function discoveredNetworkKeys(
   host: DiscoveredNetwork | null,
   internalAlreadySet: boolean,
-  opts: { internalSubnet?: string; secureMgmtAlreadySet?: boolean } = {},
+  opts: {
+    internalSubnet?: string;
+    secureMgmtAlreadySet?: boolean;
+    /** Zone the control plane itself occupies; first install records there, not `internal`. */
+    controlPlaneZone?: NetworkZone;
+  } = {},
 ): Record<string, string> {
   if (!host) return {};
 
   if (!internalAlreadySet) {
+    const targetZone = opts.controlPlaneZone ?? 'internal';
+    if (targetZone !== 'internal' && opts.secureMgmtAlreadySet) return {};
     return {
-      'network.internal.subnet': host.subnet,
-      'network.internal.gateway': host.gateway,
+      [`network.${targetZone}.subnet`]: host.subnet,
+      [`network.${targetZone}.gateway`]: host.gateway,
     };
   }
 
@@ -118,6 +133,15 @@ function readValue(db: DbClient, key: string): string | undefined {
   return db.select().from(systemConfig).where(eq(systemConfig.key, key)).get()?.value ?? undefined;
 }
 
+/**
+ * The zone the control plane actually landed in, from its deployed-system row
+ * (same source `loadControlPlaneSubnet` reads). Undefined when celilo-mgmt has
+ * no system recorded yet, so the caller falls back to `internal`.
+ */
+function controlPlaneZone(db: DbClient): NetworkZone | undefined {
+  return asZone(getModuleSystems(CONTROL_PLANE_MODULE_ID, db)[0]?.zone) ?? undefined;
+}
+
 /**
  * Discover the network this box sits on and record it. Idempotent, and never
  * overwrites a value that is already set.
@@ -143,6 +167,7 @@ export function discoverAndRecordNetwork(
   const keys = discoveredNetworkKeys(host, internalSubnet !== undefined, {
     internalSubnet,
     secureMgmtAlreadySet: readValue(db, 'network.secure-mgmt.subnet') !== undefined,
+    controlPlaneZone: controlPlaneZone(db),
   });
 
   const applied: string[] = [];

package/src/services/responder-probe.test.ts

@@ -32,7 +32,7 @@ describe('ensureResponderForInterview (ISS-0025)', () => {
     origTTY = process.stdin.isTTY;
   });
   afterEach(() => {
-    if (origEnv === undefined) process.env.EVENT_BUS_DB = undefined;
+    if (origEnv === undefined) delete process.env.EVENT_BUS_DB;
     else process.env.EVENT_BUS_DB = origEnv;
     setTTY(origTTY);
     try {

package/src/services/restore-from-file.test.ts

@@ -46,8 +46,8 @@ describe('applyStagedSystemFiles', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {
@@ -207,8 +207,8 @@ describe('restoreFromArtifactFile error paths', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/restore-preflight.test.ts

@@ -25,7 +25,7 @@ describe('restore pre-flight', () => {
   afterEach(() => {
     closeDb();
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     try {
       rmSync(dir, { recursive: true, force: true });
     } catch {

package/src/services/ssh-key-manager.test.ts

@@ -99,8 +99,8 @@ describe('ssh-key-manager', () => {
 
     // Clear environment variables
     resetTestDbPath();
-    process.env.CELILO_DATA_DIR = undefined;
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_DATA_DIR;
+    delete process.env.CELILO_MASTER_KEY_PATH;
   });
 
   describe('writeTemporarySshKey', () => {

package/src/services/system-state-stage.test.ts

@@ -38,9 +38,9 @@ describe('stageSystemState', () => {
   });
 
   afterEach(() => {
-    process.env.CELILO_DATA_DIR = undefined;
+    delete process.env.CELILO_DATA_DIR;
     resetTestDbPath();
-    process.env.CELILO_MASTER_KEY_PATH = undefined;
+    delete process.env.CELILO_MASTER_KEY_PATH;
     rmSync(dataDir, { recursive: true, force: true });
   });
 

package/src/services/terraform-safety.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from 'bun:test';
+import { planAfterImportVerdict, validateTerraformPlanSafety } from './terraform-safety';
+
+/**
+ * The plan terraform actually produced on celilo-mgr at 2026-09-16T00:04Z,
+ * after `module deploy signal` imported LXC 207 and re-planned. Abridged to the
+ * lines the parser reads, and kept verbatim otherwise: a fixture written from
+ * memory of the format would pass while the product still destroyed the box.
+ */
+const POST_IMPORT_REPLACEMENT_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+Terraform used the selected providers to generate the following execution
+plan. Resource actions are indicated with the following symbols:
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # proxmox_lxc.signal must be replaced
+-/+ resource "proxmox_lxc" "signal" {
+      + ostemplate = "datacenter:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst" # forces replacement
+      ~ rootfs {
+          + storage = "datacenter" # forces replacement
+        }
+    }
+
+Plan: 1 to add, 0 to change, 1 to destroy.
+`;
+
+const CLEAN_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+No changes. Your infrastructure matches the configuration.
+`;
+
+const IN_PLACE_UPDATE_PLAN = `
+  # proxmox_lxc.signal will be updated in-place
+  ~ resource "proxmox_lxc" "signal" {
+      ~ memory = 1024 -> 2048
+    }
+
+Plan: 0 to add, 1 to change, 0 to destroy.
+`;
+
+describe('planAfterImportVerdict', () => {
+  // THE recurrence gate for celilo#1374. This exact plan was applied without
+  // validation and destroyed signal's container on a converged fleet. If this
+  // test ever passes the plan through, the defect is back.
+  test('refuses the replacement plan an import produces', () => {
+    const verdict = planAfterImportVerdict(2, POST_IMPORT_REPLACEMENT_PLAN);
+
+    expect(verdict.action).toBe('refuse');
+    if (verdict.action !== 'refuse') throw new Error('unreachable');
+    expect(verdict.error).toContain('after importing an existing resource');
+  });
+
+  // The outcome the recovery path is FOR: the import reconciled state with
+  // reality and there is nothing left to apply. Adopt, don't apply.
+  test('applies nothing when the post-import plan is clean', () => {
+    expect(planAfterImportVerdict(0, CLEAN_PLAN)).toEqual({ action: 'done' });
+  });
+
+  // A resize must still go through — refusing everything would be a different
+  // bug wearing the same fix (terraform-safety.ts rule 2, ISS-0055).
+  test('lets an in-place update through', () => {
+    expect(planAfterImportVerdict(2, IN_PLACE_UPDATE_PLAN)).toEqual({ action: 'apply' });
+  });
+
+  // An unreadable plan is not evidence of safety (D7).
+  test('refuses when the plan itself failed', () => {
+    const verdict = planAfterImportVerdict(1, 'Error: failed to refresh state');
+
+    expect(verdict.action).toBe('refuse');
+  });
+});
+
+describe('validateTerraformPlanSafety', () => {
+  // Characterises what was already true: the validator would have caught this.
+  // The defect was never a missing rule, it was a plan that never reached one.
+  test('already refuses a replacement — it was simply never asked', () => {
+    expect(validateTerraformPlanSafety(POST_IMPORT_REPLACEMENT_PLAN).safe).toBe(false);
+  });
+});