@celilo/cli 2.2.1 → 3.0.0

package/src/cli/commands/module-publish.test.ts

@@ -43,7 +43,7 @@ describe('handleModulePublish — validation', () => {
     // will skip the validation path it's trying to exercise.
     const origToken = process.env.CELILO_PUBLISH_TOKEN;
     const origDataDir = process.env.CELILO_DATA_DIR;
-    process.env.CELILO_PUBLISH_TOKEN = undefined;
+    delete process.env.CELILO_PUBLISH_TOKEN;
     process.env.CELILO_DB_PATH = `/tmp/test-celilo-no-token-${Date.now()}.db`;
     process.env.CELILO_DATA_DIR = `/tmp/test-celilo-data-${Date.now()}`;
     try {
@@ -54,7 +54,7 @@ describe('handleModulePublish — validation', () => {
       if (origToken !== undefined) process.env.CELILO_PUBLISH_TOKEN = origToken;
       resetTestDbPath();
       if (origDataDir !== undefined) process.env.CELILO_DATA_DIR = origDataDir;
-      else process.env.CELILO_DATA_DIR = undefined;
+      else delete process.env.CELILO_DATA_DIR;
     }
   });
 
@@ -99,6 +99,28 @@ describe('handleModulePublish — manifest reading', () => {
     expect(result.success).toBe(false);
     if (!result.success) expect(result.error).toContain('manifest.yml missing id or version');
   });
+
+  test('a failed module does not stop the sweep — every module is attempted and every failure is named', async () => {
+    // celilo#1369: the loop bailed at the first failed module, so modules
+    // after it were never attempted (release run 6705 left nine modules
+    // unpublished). Three dirs that each fail before any registry access,
+    // at three different checks, prove the loop reaches all of them: the
+    // returned error must name every dir, not only the first.
+    const dirA = join(TEST_DIR, 'a-missing-id');
+    const dirB = join(TEST_DIR, 'b-missing-manifest');
+    const dirC = join(TEST_DIR, 'c-missing-version');
+    for (const d of [dirA, dirB, dirC]) await mkdir(d, { recursive: true });
+    await writeFile(join(dirA, 'manifest.yml'), 'version: "1.0.0"\n');
+    await writeFile(join(dirC, 'manifest.yml'), 'id: c-module\n');
+
+    const result = await handleModulePublish([dirA, dirB, dirC], { token: 'tok' });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error).toContain(dirA);
+      expect(result.error).toContain(dirB);
+      expect(result.error).toContain(dirC);
+    }
+  });
 });
 
 // ── Revision auto-detection algorithm ────────────────────────────────────────
@@ -169,7 +191,7 @@ describe('resolveToken — precedence', () => {
       expect(t).toBe('flag-token');
     } finally {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
-      else process.env.CELILO_PUBLISH_TOKEN = undefined;
+      else delete process.env.CELILO_PUBLISH_TOKEN;
       resetTestDbPath();
     }
   });
@@ -183,7 +205,7 @@ describe('resolveToken — precedence', () => {
       expect(t).toBe('env-token');
     } finally {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
-      else process.env.CELILO_PUBLISH_TOKEN = undefined;
+      else delete process.env.CELILO_PUBLISH_TOKEN;
       resetTestDbPath();
     }
   });
@@ -193,7 +215,7 @@ describe('resolveToken — precedence', () => {
     // DB and returns null gracefully.
     const origEnv = process.env.CELILO_PUBLISH_TOKEN;
     const origDataDir = process.env.CELILO_DATA_DIR;
-    process.env.CELILO_PUBLISH_TOKEN = undefined;
+    delete process.env.CELILO_PUBLISH_TOKEN;
     process.env.CELILO_DB_PATH = `/tmp/test-celilo-resolve-empty-${Date.now()}.db`;
     process.env.CELILO_DATA_DIR = `/tmp/test-celilo-data-empty-${Date.now()}`;
     try {
@@ -203,7 +225,7 @@ describe('resolveToken — precedence', () => {
       if (origEnv !== undefined) process.env.CELILO_PUBLISH_TOKEN = origEnv;
       resetTestDbPath();
       if (origDataDir !== undefined) process.env.CELILO_DATA_DIR = origDataDir;
-      else process.env.CELILO_DATA_DIR = undefined;
+      else delete process.env.CELILO_DATA_DIR;
     }
   });
 });

package/src/cli/commands/module-publish.ts

@@ -385,23 +385,25 @@ export async function handleModulePublish(
   for (const moduleDir of args) {
     const outcome = await publishOneModule(moduleDir, opts);
     outcomes.push(outcome);
-    if (outcome.status === 'failed') {
-      // Print summary so far, then bail. Publishes are non-destructive so
-      // re-running after fixing the underlying issue picks up where we left
-      // off (already-published modules are skipped at the registry level
-      // when --revision is explicit, and auto-revision just picks the next
-      // slot — nothing duplicates).
-      printSummary(outcomes);
-      return {
-        success: false,
-        error: outcome.message,
-      };
-    }
     console.log(outcome.message);
   }
 
+  // celilo#1369: every module is attempted even after a failure, and every
+  // failure is reported together at the end. A publish is non-destructive so
+  // re-running after fixing the underlying issue picks up where we left off
+  // (already-published modules are skipped at the registry level when
+  // --revision is explicit, and auto-revision just picks the next slot —
+  // nothing duplicates).
   printSummary(outcomes);
 
+  const failed = outcomes.filter((o) => o.status === 'failed');
+  if (failed.length > 0) {
+    return {
+      success: false,
+      error: failed.map((o) => o.message).join('\n'),
+    };
+  }
+
   if (args.length === 1) {
     // Backward-compat single-module shape — keep the existing message/data
     // contract for callers (and tests) that depend on it. By this point no

package/src/cli/commands/module-update.test.ts

@@ -107,12 +107,15 @@ description: fixture
     // Seed the modules table with the "currently installed" record.
     // We deliberately put a registry-style version string in here so
     // displayVersion-less upgrades preserve the previousVersion field.
+    // celilo#1363: updatedAt is seeded frozen so the success assertions can
+    // prove the stamp actually happens whenever the version moves.
     db.insert(modules)
       .values({
         id: 'testmod',
         name: 'Test Module',
         sourcePath: installedDir,
         version: '1.0.0+5',
+        updatedAt: new Date('2026-04-25T16:26:31Z'),
         manifestData: {
           celilo_contract: '1.0',
           id: 'testmod',
@@ -126,7 +129,7 @@ description: fixture
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('returns previousVersion + newVersion in the success outcome', async () => {
@@ -153,6 +156,18 @@ description: fixture
     expect(row.version).toBe('1.0.0+6');
   });
 
+  // celilo#1363: the version moved (1.0.5+5 → +6) while updatedAt stayed at
+  // 2026-04-25, so the audit read the module as untouched and fine. The stamp
+  // must happen in updateOne itself, where every version write lives.
+  test('writing a new version stamps updatedAt', async () => {
+    const result = await updateOne(srcDir, db, {}, { quiet: true, displayVersion: '1.0.0+6' });
+    expect(result.status).toBe('success');
+
+    const row = db.select().from(modules).all()[0];
+    expect(row.version).toBe('1.0.0+6');
+    expect(row.updatedAt?.getTime()).toBeGreaterThan(new Date('2026-04-25T16:26:31Z').getTime());
+  });
+
   test('quiet=true suppresses the per-call log lines (caller renders its own)', async () => {
     // We can't easily intercept the log helpers' output without adding test
     // hooks, so instead we exercise that the call simply succeeds and
@@ -257,7 +272,7 @@ subscriptions:
         bus.close();
       }
     } finally {
-      process.env.EVENT_BUS_DB = undefined;
+      delete process.env.EVENT_BUS_DB;
     }
   });
 });
@@ -315,8 +330,8 @@ describe('registry sweep — an unanswered breaking update is not a decline', ()
     server.stop(true);
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
-    process.env.EVENT_BUS_DB = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
+    delete process.env.EVENT_BUS_DB;
   });
 
   test('reports it as unanswered, never as declined, and fails the sweep', async () => {
@@ -389,7 +404,7 @@ description: fixture
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('refuses by name, and writes NOTHING', async () => {
@@ -501,7 +516,7 @@ describe('updateOne — an update that fails partway leaves the install untouche
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   test('a failed update leaves the installed tree byte-identical', async () => {
@@ -596,7 +611,7 @@ describe('updateOne — a .netapp package source', () => {
   afterEach(() => {
     rmSync(tempDir, { recursive: true, force: true });
     resetTestDbPath();
-    process.env.CELILO_ORIGINAL_CWD = undefined;
+    delete process.env.CELILO_ORIGINAL_CWD;
   });
 
   // ce-h4of: the temp-dir cleanup ran BEFORE the staged swap, and

package/src/cli/commands/module-update.ts

@@ -52,7 +52,7 @@ type UpdateOutcome =
   | { status: 'failed'; moduleId: string; error: string }
   // `skipped` means the path expanded from a glob but isn't an
   // upgradable target — either no manifest at all (probably a non-
-  // module sibling like `modules/archive/`) or a real module that
+  // module sibling like `modules/__archive__/`) or a real module that
   // isn't installed in this celilo. Treated as a soft pass so
   // `celilo module update modules/*` does what users expect.
   | { status: 'skipped'; moduleId: string; reason: string };
@@ -115,34 +115,86 @@ export function classifyVersionChange(installed: string, latest: string): Versio
 }
 
 /**
- * Download a module package from the registry into a temp file and run
- * the standard updateOne path against it. Cleans the temp file in a
- * finally block so a mid-flight failure doesn't leak a tar.zst on disk.
+ * Download a registry package into a temp file. Shared by `fetchAndUpdate`
+ * (the full update path) and `fetchTargetManifest` (the upgrade gate that
+ * must read the TARGET manifest before it mutates anything). The index entry
+ * carries the published sha256; absence is tolerated, matching
+ * `fetchAndUpdate`'s original tolerance for entries predating cksum.
  */
-export async function fetchAndUpdate(
+export async function downloadRegistryPackage(
   client: RegistryClient,
   moduleId: string,
   version: string,
-  db: ReturnType<typeof getDb>,
-  flags: Record<string, string | boolean>,
-): Promise<UpdateOutcome> {
+): Promise<{ ok: true; tmpPath: string } | { ok: false; error: string }> {
   const tmpPath = join(tmpdir(), `${moduleId}-${version}-${Date.now()}.netapp`);
   try {
-    // The index entry carries the published sha256. Look it up here rather than
-    // thread it through five call sites, so a short download is caught as a bad
-    // transfer instead of surfacing later as "zlib: unexpected end of file".
-    // Absence is tolerated: an entry predating cksum still downloads.
     const entries = await client.getIndex(moduleId).catch(() => []);
     const cksum = entries.find((entry) => entry.vers === version)?.cksum;
     const pkgData = await client.download(moduleId, version, cksum);
     await Bun.write(tmpPath, pkgData);
+    return { ok: true, tmpPath };
   } catch (err) {
     return {
-      status: 'failed',
-      moduleId,
+      ok: false,
       error: `Download failed: ${err instanceof Error ? err.message : String(err)}`,
     };
   }
+}
+
+/**
+ * Read the manifest of a registry version WITHOUT installing it: download,
+ * extract to a temp dir, parse manifest.yml, clean up. Used by the upgrade
+ * path to gate on the target's capability requirements before any state
+ * changes (celilo#1361). Failure to fetch or parse is not itself fatal — the
+ * caller proceeds to `fetchAndUpdate`, which reports the same failure through
+ * its own channel.
+ */
+export async function fetchTargetManifest(
+  client: RegistryClient,
+  moduleId: string,
+  version: string,
+): Promise<{ ok: true; manifest: ModuleManifest } | { ok: false }> {
+  const downloaded = await downloadRegistryPackage(client, moduleId, version);
+  if (!downloaded.ok) return { ok: false };
+  try {
+    const extractResult = await extractPackage(downloaded.tmpPath);
+    if (!extractResult.success || !extractResult.tempDir) return { ok: false };
+    try {
+      const manifestPath = join(extractResult.tempDir, 'manifest.yml');
+      if (!existsSync(manifestPath)) return { ok: false };
+      const parsed = parseYaml(readFileSync(manifestPath, 'utf-8'));
+      return { ok: true, manifest: ModuleManifestSchema.parse(parsed) };
+    } finally {
+      await cleanupTempDir(extractResult.tempDir);
+    }
+  } catch {
+    return { ok: false };
+  } finally {
+    try {
+      await unlink(downloaded.tmpPath);
+    } catch {}
+  }
+}
+
+/**
+ * Download a module package from the registry into a temp file and run
+ * the standard updateOne path against it. Cleans the temp file in a
+ * finally block so a mid-flight failure doesn't leak a tar.zst on disk.
+ */
+export async function fetchAndUpdate(
+  client: RegistryClient,
+  moduleId: string,
+  version: string,
+  db: ReturnType<typeof getDb>,
+  flags: Record<string, string | boolean>,
+): Promise<UpdateOutcome> {
+  // The download (index lookup, cksum verification, temp write) is shared
+  // with `fetchTargetManifest`, which reads the same package before this
+  // update path ever runs.
+  const downloaded = await downloadRegistryPackage(client, moduleId, version);
+  if (!downloaded.ok) {
+    return { status: 'failed', moduleId, error: downloaded.error };
+  }
   try {
     // Registry packages are pre-verified at publish time; skip the
     // signature check here to match `module import`'s registry path.
@@ -153,14 +205,14 @@ export async function fetchAndUpdate(
     // log line — without it, output would say "v1.0.0 → v1.0.0" because
     // the manifest semver doesn't include the +N revision.
     return await updateOne(
-      tmpPath,
+      downloaded.tmpPath,
       db,
       { ...flags, 'skip-verify': true },
       { quiet: true, displayVersion: version },
     );
   } finally {
     try {
-      await unlink(tmpPath);
+      await unlink(downloaded.tmpPath);
     } catch {}
   }
 }
@@ -475,12 +527,15 @@ export async function updateOne(
 
   // Update manifest in database. We persist the display version (with
   // +N when known) so subsequent `module list` / `module update` calls
-  // see the same version string the registry reported.
+  // see the same version string the registry reported. updatedAt moves with
+  // the version: a frozen timestamp beside a new version read as "nothing
+  // happened here" to the audit (celilo#1363).
   db.update(modules)
     .set({
       manifestData: newManifest as unknown as Record<string, unknown>,
       version: newVersion,
       name: newManifest.name,
+      updatedAt: new Date(),
     })
     .where(eq(modules.id, moduleId))
     .run();
@@ -557,7 +612,7 @@ export async function handleModuleUpdate(
   );
 
   // Skips that fall under a wildcard expansion (e.g. modules/* picking
-  // up `modules/archive/`) shouldn't even be mentioned — they're not
+  // up `modules/__archive__/`) shouldn't even be mentioned — they're not
   // signal. Skips for "module not installed" ARE signal because the
   // user explicitly named the path; surface those.
   const meaningfulSkips = skipped.filter((r) => !r.reason.startsWith('not a module directory'));

package/src/cli/commands/module-upgrade-gate.test.ts

@@ -0,0 +1,154 @@
+/**
+ * The registry-poll capability gate (celilo#1361): `module upgrade` reads the
+ * TARGET version's manifest BEFORE updating anything, and defers — without
+ * changing any state — when the deployed capability providers cannot serve
+ * its requirements.
+ *
+ * celilo-website burned six release revisions (+1 through +6) on exactly
+ * this: every poll attempt updated the stored version, failed in caddy's
+ * publish hook ("sourceDir is required" against a provider built before
+ * b67c9423), recorded the new version beside the old VERIFIED state, and
+ * re-triggered on the next tick. The gate makes that sequence impossible.
+ *
+ * The RegistryClient is spied (the established pattern in
+ * `module-import-registry.test.ts`); the download returns a REAL tar package
+ * carrying only a manifest, which is all `fetchTargetManifest` reads.
+ */
+
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import type { Mock } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { create as tarCreate } from 'tar';
+import { getDb } from '../../db/client';
+import { capabilities, modules } from '../../db/schema';
+import type { IndexEntry } from '../../registry/client';
+import { RegistryClient } from '../../registry/client';
+import { resetTestDbPath } from '../../test-utils/db-path';
+import { handleModuleUpgrade } from './module-upgrade';
+
+function entry(vers: string): IndexEntry {
+  return { name: 'celilo-website', vers, deps: [], cksum: 'abc', yanked: false };
+}
+
+/** A minimal registry package: a tar whose root is manifest.yml. */
+async function packageWithManifest(manifestYaml: string): Promise<ArrayBuffer> {
+  const dir = mkdtempSync(join(tmpdir(), 'celilo-upgrade-pkg-'));
+  await writeFile(join(dir, 'manifest.yml'), manifestYaml);
+  const tarPath = join(dir, 'pkg.netapp');
+  await tarCreate({ file: tarPath, cwd: dir, portable: true }, ['manifest.yml']);
+  const bytes = await Bun.file(tarPath).arrayBuffer();
+  rmSync(dir, { recursive: true, force: true });
+  return bytes;
+}
+
+const MANIFEST = (publicWebVersion: string) => `
+celilo_contract: "1.0"
+id: celilo-website
+name: Celilo Website
+version: 2.0.0
+requires:
+  capabilities:
+    - name: public_web
+      version: ${publicWebVersion}
+`;
+
+let tempDir: string;
+let getIndexSpy: Mock<(name: string) => Promise<IndexEntry[]>>;
+let downloadSpy: Mock<(name: string, vers: string) => Promise<ArrayBuffer>>;
+
+beforeEach(() => {
+  tempDir = mkdtempSync(join(tmpdir(), 'celilo-upgrade-test-'));
+  process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+  process.env.CELILO_DATA_DIR = tempDir;
+  getIndexSpy = spyOn(RegistryClient.prototype, 'getIndex').mockResolvedValue([entry('2.0.0')]);
+  downloadSpy = spyOn(RegistryClient.prototype, 'download').mockResolvedValue(new ArrayBuffer(0));
+});
+
+afterEach(() => {
+  getIndexSpy.mockRestore();
+  downloadSpy.mockRestore();
+  rmSync(tempDir, { recursive: true, force: true });
+  resetTestDbPath();
+  delete process.env.CELILO_DATA_DIR;
+});
+
+function seedFleet(caddyPublicWebVersion: string): void {
+  const db = getDb();
+  // sourcePath must be a real writable dir: when the gate does NOT fire, the
+  // flow proceeds into updateOne, which stages the new copy beside it.
+  const installDir = (id: string): string => {
+    const p = join(tempDir, 'modules', id);
+    mkdirSync(p, { recursive: true });
+    return p;
+  };
+  db.insert(modules)
+    .values({
+      id: 'celilo-website',
+      name: 'Celilo Website',
+      version: '1.0.5',
+      manifestData: { id: 'celilo-website', name: 'Celilo Website', version: '1.0.5' },
+      sourcePath: installDir('celilo-website'),
+    })
+    .run();
+  db.insert(modules)
+    .values({
+      id: 'caddy',
+      name: 'Caddy',
+      version: '2.3.3+1',
+      manifestData: { id: 'caddy', name: 'Caddy', version: '2.3.3' },
+      sourcePath: installDir('caddy'),
+    })
+    .run();
+  db.insert(capabilities)
+    .values({
+      moduleId: 'caddy',
+      capabilityName: 'public_web',
+      version: caddyPublicWebVersion,
+      data: {},
+    })
+    .run();
+}
+
+describe('handleModuleUpgrade — the capability gate (celilo#1361)', () => {
+  test('defers an upgrade whose requirement no deployed provider serves', async () => {
+    seedFleet('3.1.0');
+    downloadSpy.mockImplementation(async () => packageWithManifest(MANIFEST('4.0.0')));
+
+    const result = await handleModuleUpgrade(['celilo-website'], {});
+
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.deferred).toBe(true);
+      expect(result.error).toContain('deferred');
+      expect(result.error).toContain('public_web@4.0.0');
+      expect(result.error).toContain('caddy');
+    }
+    // The point of deferring: NO state changed. The stored version still
+    // reads the installed release and will re-read as up-to-date-candidate
+    // next tick instead of looking upgraded-but-broken (celilo#1363's shape).
+    const row = getDb()
+      .select()
+      .from(modules)
+      .all()
+      .find((m) => m.id === 'celilo-website');
+    expect(row?.version).toBe('1.0.5');
+  });
+
+  test('does not defer when the deployed provider serves the requirement', async () => {
+    seedFleet('3.1.0');
+    downloadSpy.mockImplementation(async () => packageWithManifest(MANIFEST('3.0.0')));
+
+    const result = await handleModuleUpgrade(['celilo-website'], {});
+
+    // Whatever happens downstream (the minimal package has no scripts), the
+    // gate itself must not have fired — `deferred` marks a capability wall.
+    if (!result.success) {
+      expect(result.deferred).toBeUndefined();
+    } else {
+      expect(result.success).toBe(true);
+    }
+  });
+});

package/src/cli/commands/module-upgrade.test.ts

@@ -1,5 +1,16 @@
-import { describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import type { Mock } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { create as tarCreate } from 'tar';
+import { type DbClient, getDb } from '../../db/client';
+import { type ModuleState, modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { RegistryClient } from '../../registry/client';
+import * as moduleDeploy from '../../services/module-deploy';
+import { resetTestDbPath } from '../../test-utils/db-path';
 import {
   type PollCandidate,
   isPollInvocation,
@@ -8,6 +19,7 @@ import {
   pickAutoUpgrade,
   pickUpgradePolicy,
   selectPollTargets,
+  upgradeOneModule,
 } from './module-upgrade';
 
 /** Minimal manifest fixture; only `hooks` matters for the backup gate. */
@@ -70,6 +82,7 @@ describe('selectPollTargets (ISS-0139 — opted-in + a newer registry version)',
     installed: '1.0.0',
     latest: '1.0.1',
     autoUpgrade: true,
+    inError: false,
     ...over,
   });
 
@@ -92,6 +105,13 @@ describe('selectPollTargets (ISS-0139 — opted-in + a newer registry version)',
     expect(selectPollTargets([base({ latest: null })])).toEqual([]);
   });
 
+  // celilo#1363: the poll burned five attempts redeploying celilo-website
+  // against a failure that never went away. A module in ERROR stays skipped
+  // until an attended health check clears it.
+  test('skips modules in ERROR state (a failed upgrade deploy)', () => {
+    expect(selectPollTargets([base({ inError: true })])).toEqual([]);
+  });
+
   test('picks only the eligible subset from a mixed set', () => {
     const targets = selectPollTargets([
       base({ moduleId: 'a', installed: '1.0.0', latest: '1.0.1', autoUpgrade: true }),
@@ -136,3 +156,97 @@ describe('needsPreUpgradeBackup (ISS-0168 — gate on the TARGET version manifes
     expect(needsPreUpgradeBackup('safe', manifest(undefined))).toBe(false);
   });
 });
+
+// celilo#1363: fetchAndUpdate commits the new version to the store BEFORE the
+// deploy runs, so a failed deploy left a new version recorded beside a stale
+// VERIFIED state and a frozen updatedAt, and the audit read the module as
+// fine. Option A: the row must say what happened — state ERROR with the
+// error, and updatedAt moving whenever the version moves.
+describe('upgradeOneModule — a failed deploy records the failure in the row (celilo#1363)', () => {
+  const FROZEN = new Date('2026-04-25T16:26:31Z');
+  let tempDir: string;
+  let installedDir: string;
+  let db: DbClient;
+  let getIndexSpy: Mock<(name: string) => Promise<unknown[]>>;
+  let downloadSpy: Mock<(name: string, vers: string, cksum?: string) => Promise<ArrayBuffer>>;
+  let deploySpy: Mock<typeof moduleDeploy.deployModule>;
+
+  beforeEach(async () => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-upgrade-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+
+    installedDir = join(tempDir, 'installed', 'testmod');
+    mkdirSync(installedDir, { recursive: true });
+    writeFileSync(
+      join(installedDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture\n',
+    );
+
+    db = getDb();
+    db.insert(modules)
+      .values({
+        id: 'testmod',
+        name: 'Test Module',
+        sourcePath: installedDir,
+        version: '1.0.0+5',
+        state: 'VERIFIED',
+        updatedAt: FROZEN,
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'testmod',
+          name: 'Test Module',
+          version: '1.0.0',
+        },
+      })
+      .run();
+
+    // Build the registry package for a patch bump (1.0.0+5 → 1.0.0+6).
+    // Patch/revision → fast posture, so no snapshot and no backup are needed
+    // on the path to the deploy.
+    const srcDir = join(tempDir, 'pkg-src');
+    mkdirSync(srcDir, { recursive: true });
+    writeFileSync(
+      join(srcDir, 'manifest.yml'),
+      'celilo_contract: "1.0"\nid: testmod\nname: Test Module\nversion: 1.0.0\ndescription: fixture v6\n',
+    );
+    const pkgPath = join(tempDir, 'testmod-1.0.0.netapp');
+    await tarCreate({ file: pkgPath, cwd: srcDir }, ['manifest.yml']);
+    const pkgBytes = new Uint8Array(await Bun.file(pkgPath).arrayBuffer());
+
+    getIndexSpy = spyOn(RegistryClient.prototype, 'getIndex').mockResolvedValue([
+      { name: 'testmod', vers: '1.0.0+6', deps: [], cksum: 'abc', yanked: false },
+    ]);
+    downloadSpy = spyOn(RegistryClient.prototype, 'download').mockResolvedValue(pkgBytes.buffer);
+    deploySpy = spyOn(moduleDeploy, 'deployModule').mockResolvedValue({
+      success: false,
+      error: 'ssh: connection refused',
+      phases: {},
+    });
+  });
+
+  afterEach(() => {
+    getIndexSpy.mockRestore();
+    downloadSpy.mockRestore();
+    deploySpy.mockRestore();
+    rmSync(tempDir, { recursive: true, force: true });
+    resetTestDbPath();
+    delete process.env.CELILO_ORIGINAL_CWD;
+  });
+
+  test('a deploy failure leaves state ERROR, the new version, and a moved updatedAt', async () => {
+    const mod = db.select().from(modules).where(eq(modules.id, 'testmod')).get();
+    if (!mod) throw new Error('seed row missing');
+
+    const result = await upgradeOneModule(mod, '1.0.0+6', new RegistryClient(''), db, {});
+
+    expect(result.success).toBe(false);
+    const row = db.select().from(modules).where(eq(modules.id, 'testmod')).get();
+    if (!row) throw new Error('row missing after upgrade');
+    expect(row.version).toBe('1.0.0+6');
+    expect(row.state).toBe<ModuleState>('ERROR');
+    expect(row.errorMessage).toContain('1.0.0+6');
+    expect(row.errorMessage).toContain('ssh: connection refused');
+    expect(row.updatedAt?.getTime()).toBeGreaterThan(FROZEN.getTime());
+  });
+});