@celilo/cli 2.3.0 → 3.1.0

package/src/services/provider-converge.test.ts

@@ -0,0 +1,209 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { parse as parseYaml } from 'yaml';
+import type { DbClient } from '../db/client';
+import { modules } from '../db/schema';
+import { setupTestDatabaseAt } from '../test-utils/database';
+import { resetTestDbPath } from '../test-utils/db-path';
+import {
+  type ProviderArtifacts,
+  convergeProviderConfig,
+  providerConfigVarsPath,
+  providerConfigVarsYaml,
+  recordUnresolvedConsumers,
+} from './provider-converge';
+
+const HASH = 'a'.repeat(64);
+
+function artifacts(overrides: Partial<ProviderArtifacts> = {}): ProviderArtifacts {
+  return {
+    files: [{ path: '/etc/caddy/Caddyfile', content: 'peterbanka.org {\n\ttls internal\n}\n' }],
+    sites: [
+      {
+        slug: 'peterbanka-org',
+        moduleId: 'peterbanka-org',
+        contentHash: HASH,
+        hostnames: ['peterbanka.org'],
+        sourceDir: '/var/celilo/modules/peterbanka-org/site/dist',
+      },
+    ],
+    unresolved: [],
+    retention: 5,
+    ...overrides,
+  };
+}
+
+describe('providerConfigVarsYaml — the provider renders, celilo carries', () => {
+  it('carries each rendered file so the role can place it verbatim', () => {
+    const vars = parseYaml(providerConfigVarsYaml(artifacts()));
+
+    expect(vars.provider_config_files).toEqual([
+      { path: '/etc/caddy/Caddyfile', content: 'peterbanka.org {\n\ttls internal\n}\n' },
+    ]);
+  });
+
+  it('carries the sites under the variable the static-content role already reads', () => {
+    const vars = parseYaml(providerConfigVarsYaml(artifacts()));
+
+    expect(vars.static_release_retention).toBe(5);
+    expect(vars.static_releases).toEqual([
+      {
+        slug: 'peterbanka-org',
+        content_hash: HASH,
+        hostnames: ['peterbanka.org'],
+        source_dir: '/var/celilo/modules/peterbanka-org/site/dist',
+      },
+    ]);
+  });
+
+  it('omits overlay_dir when there is none, so the role guard reads a clean variable', () => {
+    const withOverlay = artifacts({
+      sites: [
+        { ...artifacts().sites[0], overlayDir: '/var/celilo/modules/peterbanka-org/state/site' },
+      ],
+    });
+
+    expect(parseYaml(providerConfigVarsYaml(artifacts())).static_releases[0].overlay_dir).toBe(
+      undefined,
+    );
+    expect(parseYaml(providerConfigVarsYaml(withOverlay)).static_releases[0].overlay_dir).toBe(
+      '/var/celilo/modules/peterbanka-org/state/site',
+    );
+  });
+
+  it("one consumer the provider could not render does not remove another's site", () => {
+    const partial = artifacts({
+      unresolved: [
+        { moduleId: 'byoi', reason: 'no built site at /var/celilo/modules/byoi/site/dist' },
+      ],
+    });
+
+    const vars = parseYaml(providerConfigVarsYaml(partial));
+
+    expect(vars.static_releases.map((r: { slug: string }) => r.slug)).toEqual(['peterbanka-org']);
+  });
+
+  it('is deterministic, so an unchanged desired state writes an unchanged file', () => {
+    expect(providerConfigVarsYaml(artifacts())).toBe(providerConfigVarsYaml(artifacts()));
+  });
+});
+
+describe('providerConfigVarsPath — lands in the generated inventory', () => {
+  it('writes into the auto-loaded group_vars directory', () => {
+    expect(providerConfigVarsPath('/tmp/generated')).toBe(
+      '/tmp/generated/ansible/inventory/group_vars/all/provider_config.yml',
+    );
+  });
+});
+
+describe('recordUnresolvedConsumers — the failure belongs to the consumer', () => {
+  let dir: string;
+  let db: DbClient;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'provider-converge-'));
+    const dbPath = join(dir, 'celilo.db');
+    process.env.CELILO_DB_PATH = dbPath;
+    db = await setupTestDatabaseAt(dbPath);
+
+    for (const id of ['caddy', 'byoi', 'peterbanka-org']) {
+      db.insert(modules)
+        .values({
+          id,
+          name: id,
+          version: '1.0.0',
+          manifestData: {},
+          sourcePath: join(dir, 'modules', id),
+          state: 'VERIFIED',
+        })
+        .onConflictDoNothing()
+        .run();
+    }
+  });
+
+  afterEach(() => {
+    db.$client.close();
+    resetTestDbPath();
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  function stateOf(id: string) {
+    return db.select().from(modules).where(eq(modules.id, id)).get();
+  }
+
+  it('records the consumer in ERROR with the reason it could not be rendered', () => {
+    recordUnresolvedConsumers(db, 'caddy', [
+      { moduleId: 'byoi', reason: 'no built site at /var/celilo/modules/byoi/site/dist' },
+    ]);
+
+    const byoi = stateOf('byoi');
+    expect(byoi?.state).toBe('ERROR');
+    expect(byoi?.errorMessage).toContain('no built site');
+  });
+
+  it('leaves the provider and every other consumer alone', () => {
+    recordUnresolvedConsumers(db, 'caddy', [{ moduleId: 'byoi', reason: 'no built site' }]);
+
+    expect(stateOf('caddy')?.state).toBe('VERIFIED');
+    expect(stateOf('peterbanka-org')?.state).toBe('VERIFIED');
+  });
+
+  it('returns the modules it recorded, so the converge can report them', () => {
+    const recorded = recordUnresolvedConsumers(db, 'caddy', [
+      { moduleId: 'byoi', reason: 'no built site' },
+    ]);
+
+    expect(recorded).toEqual(['byoi']);
+  });
+
+  it('records the consumer even when the converge cannot run at all', async () => {
+    const result = await convergeProviderConfig(db, 'not-installed-provider', {
+      files: [],
+      sites: [],
+      unresolved: [{ moduleId: 'byoi', reason: 'no built site' }],
+      retention: 5,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('not installed');
+    // The consumer's fault is recorded whatever happens to the provider run:
+    // the two failures are unrelated and the operator needs both.
+    expect(result.unresolved).toEqual(['byoi']);
+    expect(stateOf('byoi')?.state).toBe('ERROR');
+  });
+
+  it('refuses a generated project that predates the converge, naming the redeploy', async () => {
+    const generated = join(dir, 'modules', 'caddy', 'generated', 'ansible', 'roles');
+    mkdirSync(generated, { recursive: true });
+    writeFileSync(join(generated, 'main.yml'), '- name: does not read the new vars\n', 'utf-8');
+
+    const result = await convergeProviderConfig(db, 'caddy', artifacts());
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('predates the provider converge');
+    expect(result.error).toContain('celilo module deploy caddy');
+    // Nothing was written: the guard scans the tree for the variable name, and
+    // the vars file would land inside that tree carrying it. Writing first
+    // makes the guard find its own output and pass forever (celilo#1248).
+    expect(result.varsPath).toBe(undefined);
+    expect(existsSync(providerConfigVarsPath(join(dir, 'modules', 'caddy', 'generated')))).toBe(
+      false,
+    );
+  });
+
+  it('ignores a module that is not installed rather than inventing a row', () => {
+    const recorded = recordUnresolvedConsumers(db, 'caddy', [
+      { moduleId: 'never-installed', reason: 'no built site' },
+    ]);
+
+    expect(recorded).toEqual([]);
+    expect(stateOf('never-installed')).toBe(undefined);
+  });
+});

package/src/services/provider-converge.ts

@@ -0,0 +1,241 @@
+/**
+ * The provider converge (openspec/changes/providers-converge-declared-state).
+ *
+ * A provider renders its own config from the rows it declares, and celilo makes
+ * the host match by running that provider's own Ansible role. One writer on the
+ * box, one path from declared state to a running config.
+ *
+ * Generalised from `static-content-converge.ts`, which already does this for
+ * static site content: desired state into the provider's generated inventory,
+ * then a tag-scoped `executeAnsible`. The difference is who decides what the
+ * desired state is. There, core walks every route row in the fleet and throws
+ * when any one module's site is missing (celilo#1383 — two out-of-tree modules
+ * with no `site/dist` made the public ingress undeployable). Here the provider
+ * hands over what it rendered, and a consumer it could not render is recorded
+ * against that consumer.
+ */
+
+import { existsSync, rmSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { stringify as stringifyYaml } from 'yaml';
+import type { DbClient } from '../db/client';
+import { modules } from '../db/schema';
+import { ansibleTreeMentions } from './static-content-converge';
+
+/** One file the provider wants on its host, rendered by the provider. */
+export interface ProviderConfigFile {
+  /** Absolute path on the provider host. */
+  path: string;
+  /** The rendered contents. */
+  content: string;
+}
+
+/** A consumer's site the provider host must carry. */
+export interface ProviderSite {
+  slug: string;
+  moduleId: string;
+  contentHash: string;
+  hostnames: string[];
+  sourceDir: string;
+  overlayDir?: string;
+}
+
+/** A consumer the provider could not render, and why. */
+export interface UnresolvedConsumer {
+  moduleId: string;
+  reason: string;
+}
+
+/** Everything the provider rendered for one converge. */
+export interface ProviderArtifacts {
+  files: ProviderConfigFile[];
+  sites: ProviderSite[];
+  unresolved: UnresolvedConsumer[];
+  retention: number;
+}
+
+/**
+ * Where the provider's desired state lands inside its generated project.
+ *
+ * `group_vars/all/` is the existing auto-load directory — the same one
+ * `static_content.yml` uses — so no playbook change is needed to read it.
+ */
+export function providerConfigVarsPath(generatedPath: string): string {
+  return join(generatedPath, 'ansible', 'inventory', 'group_vars', 'all', 'provider_config.yml');
+}
+
+/**
+ * Render the vars file. Presentation function (Rule 10.1) — deterministic YAML,
+ * so an unchanged desired state writes a byte-identical file and the role's
+ * config task reports no change.
+ *
+ * `static_releases` keeps its name: the role tasks that converge `/srv/www`
+ * already read it, and renaming a working variable to match a new writer would
+ * be churn with a live-site failure mode.
+ */
+export function providerConfigVarsYaml(artifacts: ProviderArtifacts): string {
+  const vars = {
+    provider_config_files: artifacts.files.map((file) => ({
+      path: file.path,
+      content: file.content,
+    })),
+    static_release_retention: artifacts.retention,
+    static_releases: artifacts.sites.map((site) => ({
+      slug: site.slug,
+      content_hash: site.contentHash,
+      hostnames: site.hostnames,
+      source_dir: site.sourceDir,
+      // Absent when there is no overlay, so the role's `when:` guard reads a
+      // clean variable rather than an empty string a copy task would choke on.
+      ...(site.overlayDir ? { overlay_dir: site.overlayDir } : {}),
+    })),
+  };
+  const header =
+    '# Desired provider state, generated by celilo (providers-converge-declared-state).\n' +
+    '# Hand edits are overwritten by the next converge.\n';
+  return `${header}${stringifyYaml(vars, { lineWidth: 0, sortMapEntries: true })}`;
+}
+
+/**
+ * Record each consumer the provider could not render, against that consumer.
+ *
+ * The provider is not at fault for a consumer that ships no built site, and the
+ * fleet is not at fault either: before this, one such module threw in core's
+ * plan and no site converged at all (celilo#1383). The state has to be honest
+ * about which module is broken (celilo#1363), so the row says ERROR and carries
+ * the reason the provider gave.
+ *
+ * A module that is not installed is skipped rather than inserted: celilo cannot
+ * record a state for something it does not have.
+ */
+export function recordUnresolvedConsumers(
+  db: DbClient,
+  providerModuleId: string,
+  unresolved: UnresolvedConsumer[],
+): string[] {
+  const recorded: string[] = [];
+
+  for (const consumer of unresolved) {
+    const existing = db.select().from(modules).where(eq(modules.id, consumer.moduleId)).get();
+    if (!existing) continue;
+
+    db.update(modules)
+      .set({
+        state: 'ERROR',
+        errorMessage: `'${providerModuleId}' could not serve this module: ${consumer.reason}`,
+        updatedAt: new Date(),
+      })
+      .where(eq(modules.id, consumer.moduleId))
+      .run();
+    recorded.push(consumer.moduleId);
+  }
+
+  return recorded;
+}
+
+/** What one converge did, for the caller to report. */
+export interface ProviderConvergeResult {
+  success: boolean;
+  error?: string;
+  /** The written vars file, absolute — for logs and tests. */
+  varsPath?: string;
+  /** Consumers recorded in ERROR because the provider could not render them. */
+  unresolved: string[];
+}
+
+/**
+ * The tags a converge runs. The provider's whole playbook re-runs package
+ * installation and service enablement, which a route change has no business
+ * touching; these two cover the file placement and `/srv/www`.
+ */
+const CONVERGE_TAGS = ['provider_config', 'static_content'];
+
+/**
+ * Plan, write, converge: make the provider's host match what the provider
+ * rendered.
+ *
+ * `generatedPath` is rendered on demand when it is missing, because a
+ * successful deploy deletes the generated tree by design (D4 of
+ * control-plane-stops-building-modules) and generation is fast and local.
+ */
+export async function convergeProviderConfig(
+  db: DbClient,
+  providerModuleId: string,
+  artifacts: ProviderArtifacts,
+  options?: { tags?: string[] },
+): Promise<ProviderConvergeResult> {
+  const unresolved = recordUnresolvedConsumers(db, providerModuleId, artifacts.unresolved);
+
+  const module = db.select().from(modules).where(eq(modules.id, providerModuleId)).get();
+  if (!module) {
+    return {
+      success: false,
+      error: `Provider module '${providerModuleId}' is not installed`,
+      unresolved,
+    };
+  }
+
+  const generatedPath = join(module.sourcePath, 'generated');
+  if (!existsSync(generatedPath)) {
+    const { generateTemplates } = await import('../templates/generator');
+    const rendered = await generateTemplates({
+      moduleId: providerModuleId,
+      modulePath: module.sourcePath,
+      outputPath: generatedPath,
+      db,
+      skipVariableValidation: false,
+    });
+    if (!rendered.success) {
+      return {
+        success: false,
+        error:
+          `Provider '${providerModuleId}' has no generated deploy project at ${generatedPath} ` +
+          `and rendering one failed: ${rendered.error ?? 'unknown error'}. ` +
+          `Run \`celilo module deploy ${providerModuleId}\` once, then retry.`,
+        unresolved,
+      };
+    }
+  }
+
+  // A generated project that predates the converge role tasks would read the
+  // new vars file and place nothing, so the desired state would be written and
+  // silently never applied. The variable appearing nowhere in the tree is the
+  // tell. Generic string check — core names no module.
+  //
+  // CHECKED BEFORE THE VARS ARE WRITTEN, and the order is the whole point: the
+  // vars file lands inside the tree being scanned and contains the variable
+  // name, so a guard that runs after the write finds its own output and can
+  // never fail. That is celilo#1248's bug — a check that cannot reach its
+  // subject — reintroduced by write order rather than by path.
+  const ansiblePath = join(generatedPath, 'ansible');
+  if (existsSync(ansiblePath) && !ansibleTreeMentions(ansiblePath, 'provider_config_files')) {
+    return {
+      success: false,
+      error: `The generated project for '${providerModuleId}' predates the provider converge (its role never reads provider_config_files). Redeploy the provider (\`celilo module deploy ${providerModuleId}\`) to regenerate it, then retry.`,
+      unresolved,
+    };
+  }
+
+  const varsPath = providerConfigVarsPath(generatedPath);
+  await mkdir(join(varsPath, '..'), { recursive: true });
+  await writeFile(varsPath, providerConfigVarsYaml(artifacts), 'utf-8');
+
+  const { executeAnsible } = await import('./deploy-ansible');
+  const result = await executeAnsible(generatedPath, { tags: options?.tags ?? CONVERGE_TAGS });
+  if (!result.success) {
+    return {
+      success: false,
+      error: `Provider converge failed on ${providerModuleId}: ${result.error ?? 'unknown error'}`,
+      varsPath,
+      unresolved,
+    };
+  }
+
+  // The converge rendered the tree, used it, and is done with it: desired state
+  // is rebuilt from the declared rows every time and never kept as a record
+  // (design D5). On the failure paths above the tree stays for inspection.
+  rmSync(generatedPath, { recursive: true, force: true });
+  return { success: true, varsPath, unresolved };
+}

package/src/services/static-content-converge.test.ts

@@ -152,6 +152,45 @@ describe('planStaticContent — the declared release set (D10 task 4.1)', () =>
 
     expect(() => planStaticContent(db)).toThrow(/no built site/);
   });
+
+  function pause(moduleId: string) {
+    db.update(modules).set({ state: 'PAUSED' }).where(eq(modules.id, moduleId)).run();
+  }
+
+  it("a paused module's slug is left alone, even one that would throw, and the rest converge (celilo#1383)", () => {
+    insertRoute({ slug: 'lunacycle', moduleId: 'lunacycle', hostname: 'lunacycle.net' });
+    insertRoute({
+      slug: 'lunacycle',
+      moduleId: 'lunacycle',
+      hostname: 'www.lunacycle.net',
+      contentHash: HASH2,
+    });
+    rmSync(join(dir, 'modules', 'lunacycle', 'site', 'dist'), { recursive: true, force: true });
+    insertRoute({
+      slug: 'hello-foo',
+      moduleId: 'hello-foo',
+      hostname: 'www.example.com',
+      path: '/foo',
+    });
+    pause('lunacycle');
+
+    expect(planStaticContent(db).map((r) => r.slug)).toEqual(['hello-foo']);
+  });
+
+  it('a paused module that is publishing (an unpause redeploy) still converges its own slug', () => {
+    insertRoute({ slug: 'lunacycle', moduleId: 'lunacycle', hostname: 'lunacycle.net' });
+    pause('lunacycle');
+
+    expect(planStaticContent(db, 'lunacycle').map((r) => r.slug)).toEqual(['lunacycle']);
+  });
+
+  it('a slug shared by a paused and an active module is still a contradiction', () => {
+    insertRoute({ slug: 'about', moduleId: 'lunacycle', hostname: 'a.example.com' });
+    insertRoute({ slug: 'about', moduleId: 'hello-foo', hostname: 'b.example.com' });
+    pause('lunacycle');
+
+    expect(() => planStaticContent(db)).toThrow(/claimed by 2 modules/);
+  });
 });
 
 describe('resolveStaticContentRetention — operator config with a default', () => {

package/src/services/static-content-converge.ts

@@ -32,6 +32,7 @@ import type { DbClient } from '../db/client';
 import { moduleConfigs, modules, webRoutes } from '../db/schema';
 import { resolveModuleStateWebRoot, resolveModuleWebRoot } from '../module/web-root';
 import { parseStoredConfigValue } from './module-config';
+import { listPausedModules } from './module-pause';
 
 /** One content-hashed release the provider host must serve. */
 export interface StaticRelease {
@@ -133,7 +134,7 @@ export function resolveStaticContentRetention(db: DbClient, providerModuleId: st
  * cannot express, so it fails here with both rows named rather than silently
  * converging one of them.
  */
-export function planStaticContent(db: DbClient): StaticRelease[] {
+export function planStaticContent(db: DbClient, publishingModuleId?: string): StaticRelease[] {
   const rows = db
     .select()
     .from(webRoutes)
@@ -147,6 +148,14 @@ export function planStaticContent(db: DbClient): StaticRelease[] {
     bySlug.set(row.slug, group);
   }
 
+  // A paused module's site is left exactly as it is — pause preserves state
+  // (module-pause spec) — so its slug is neither converged nor validated. The
+  // exception is the module publishing right now: an unpause redeploy runs
+  // on_install while the module is still PAUSED (executeUnpause clears the
+  // pause only after the redeploy succeeds). celilo#1383.
+  const paused = new Set(listPausedModules(db).map((m) => m.id));
+  if (publishingModuleId) paused.delete(publishingModuleId);
+
   const releases: StaticRelease[] = [];
   for (const [slug, group] of bySlug) {
     const moduleIds = [...new Set(group.map((r) => r.moduleId))];
@@ -157,6 +166,7 @@ export function planStaticContent(db: DbClient): StaticRelease[] {
     }
     const moduleId = moduleIds[0];
     if (!moduleId) continue;
+    if (paused.has(moduleId)) continue;
 
     const hashes = [...new Set(group.map((r) => r.contentHash))];
     if (hashes.length > 1) {
@@ -201,9 +211,13 @@ export function planStaticContent(db: DbClient): StaticRelease[] {
  * The full desired state: the release set plus the retention count resolved
  * for THIS provider module. The unit the vars file and the tests speak in.
  */
-export function buildStaticContentPlan(db: DbClient, providerModuleId: string): StaticContentPlan {
+export function buildStaticContentPlan(
+  db: DbClient,
+  providerModuleId: string,
+  publishingModuleId?: string,
+): StaticContentPlan {
   return {
-    releases: planStaticContent(db),
+    releases: planStaticContent(db, publishingModuleId),
     retention: resolveStaticContentRetention(db, providerModuleId),
   };
 }
@@ -246,10 +260,11 @@ export async function writeStaticContentVars(
   db: DbClient,
   providerModuleId: string,
   generatedPath: string,
+  publishingModuleId?: string,
 ): Promise<StaticContentConvergeResult> {
   const varsPath = staticContentVarsPath(generatedPath);
 
-  const plan = buildStaticContentPlan(db, providerModuleId);
+  const plan = buildStaticContentPlan(db, providerModuleId, publishingModuleId);
 
   await mkdir(join(varsPath, '..'), { recursive: true });
   await writeFile(varsPath, staticContentVarsYaml(plan), 'utf-8');
@@ -303,6 +318,7 @@ export function ansibleTreeMentions(dir: string, needle: string): boolean {
 export async function convergeStaticContent(
   db: DbClient,
   providerModuleId: string,
+  publishingModuleId?: string,
 ): Promise<StaticContentConvergeResult> {
   const module = db.select().from(modules).where(eq(modules.id, providerModuleId)).get();
   if (!module) {
@@ -336,7 +352,12 @@ export async function convergeStaticContent(
     }
   }
 
-  const written = await writeStaticContentVars(db, providerModuleId, generatedPath);
+  const written = await writeStaticContentVars(
+    db,
+    providerModuleId,
+    generatedPath,
+    publishingModuleId,
+  );
 
   // A generated project that predates the converge role tasks would read the
   // new vars file and converge nothing. `static_releases` appearing nowhere in

package/src/services/terraform-safety.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from 'bun:test';
+import { planAfterImportVerdict, validateTerraformPlanSafety } from './terraform-safety';
+
+/**
+ * The plan terraform actually produced on celilo-mgr at 2026-09-16T00:04Z,
+ * after `module deploy signal` imported LXC 207 and re-planned. Abridged to the
+ * lines the parser reads, and kept verbatim otherwise: a fixture written from
+ * memory of the format would pass while the product still destroyed the box.
+ */
+const POST_IMPORT_REPLACEMENT_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+Terraform used the selected providers to generate the following execution
+plan. Resource actions are indicated with the following symbols:
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # proxmox_lxc.signal must be replaced
+-/+ resource "proxmox_lxc" "signal" {
+      + ostemplate = "datacenter:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst" # forces replacement
+      ~ rootfs {
+          + storage = "datacenter" # forces replacement
+        }
+    }
+
+Plan: 1 to add, 0 to change, 1 to destroy.
+`;
+
+const CLEAN_PLAN = `
+proxmox_lxc.signal: Refreshing state... [id=node3/lxc/207]
+
+No changes. Your infrastructure matches the configuration.
+`;
+
+const IN_PLACE_UPDATE_PLAN = `
+  # proxmox_lxc.signal will be updated in-place
+  ~ resource "proxmox_lxc" "signal" {
+      ~ memory = 1024 -> 2048
+    }
+
+Plan: 0 to add, 1 to change, 0 to destroy.
+`;
+
+describe('planAfterImportVerdict', () => {
+  // THE recurrence gate for celilo#1374. This exact plan was applied without
+  // validation and destroyed signal's container on a converged fleet. If this
+  // test ever passes the plan through, the defect is back.
+  test('refuses the replacement plan an import produces', () => {
+    const verdict = planAfterImportVerdict(2, POST_IMPORT_REPLACEMENT_PLAN);
+
+    expect(verdict.action).toBe('refuse');
+    if (verdict.action !== 'refuse') throw new Error('unreachable');
+    expect(verdict.error).toContain('after importing an existing resource');
+  });
+
+  // The outcome the recovery path is FOR: the import reconciled state with
+  // reality and there is nothing left to apply. Adopt, don't apply.
+  test('applies nothing when the post-import plan is clean', () => {
+    expect(planAfterImportVerdict(0, CLEAN_PLAN)).toEqual({ action: 'done' });
+  });
+
+  // A resize must still go through — refusing everything would be a different
+  // bug wearing the same fix (terraform-safety.ts rule 2, ISS-0055).
+  test('lets an in-place update through', () => {
+    expect(planAfterImportVerdict(2, IN_PLACE_UPDATE_PLAN)).toEqual({ action: 'apply' });
+  });
+
+  // An unreadable plan is not evidence of safety (D7).
+  test('refuses when the plan itself failed', () => {
+    const verdict = planAfterImportVerdict(1, 'Error: failed to refresh state');
+
+    expect(verdict.action).toBe('refuse');
+  });
+});
+
+describe('validateTerraformPlanSafety', () => {
+  // Characterises what was already true: the validator would have caught this.
+  // The defect was never a missing rule, it was a plan that never reached one.
+  test('already refuses a replacement — it was simply never asked', () => {
+    expect(validateTerraformPlanSafety(POST_IMPORT_REPLACEMENT_PLAN).safe).toBe(false);
+  });
+});