@celilo/cli 4.0.0 → 5.0.0

package/src/services/celilo-mgmt-hooks.test.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { skipIntegration } from '../test-utils/integration-guard';
 
 import type { HookContext } from '@celilo/capabilities';
+import { configStore, secretStore } from '../hooks/test-fixtures/store-backed';
 
 // Hooks under test — imported via the scripts dir adjacent to the
 // modules/celilo-mgmt/manifest.yml. The dynamic import keeps the test
@@ -46,7 +47,7 @@ function buildContext(extras: Record<string, unknown>): HookContext {
   const { logger } = buildLogger();
   return {
     logger,
-    config: {
+    config: configStore({
       db_path: '', // populated by caller via env
       hostname: 'test-mgmt',
       target_ip: '127.0.0.1',
@@ -61,9 +62,11 @@ function buildContext(extras: Record<string, unknown>): HookContext {
       ssh_public_key: '',
       install_docker: false,
       install_terraform: false,
-    } as Record<string, unknown>,
-    secrets: {},
+    }),
+    secrets: secretStore(),
     capabilities: {},
+    systems: [],
+    stateDir: '',
     debug: false,
     screenshotDir: '',
     ...extras,

package/src/services/cross-module-read.test.ts

@@ -25,7 +25,7 @@ import {
 
 function buildManifest(caps: Array<{ name: string; version: string }>): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'm',
     name: 'm',
     version: '0.0.1',
@@ -88,7 +88,7 @@ describe('materializeCrossModuleRoot', () => {
         name: id,
         version,
         sourcePath: join(dir, 'sources', id),
-        manifestData: { id, name: id, version, celilo_contract: '1.0', requires: {} } as Record<
+        manifestData: { id, name: id, version, celilo_contract: '2.0', requires: {} } as Record<
           string,
           unknown
         >,

package/src/services/deploy-preflight.ts

@@ -112,8 +112,15 @@ export async function runPreflight(
   //    drift after deploy; this surface refuses up front so the
   //    operator gets an actionable error instead of a silent
   //    template-generation against an ABI the provider can't fulfil.
-  if (manifest.requires?.capabilities) {
-    for (const cap of manifest.requires.capabilities) {
+  // An OPTIONAL capability joins the version check but not the presence check:
+  // its provider may legitimately be absent, but when one IS installed the
+  // module's hooks call it, so another major breaks at runtime (celilo#1384).
+  {
+    const consumed = [
+      ...(manifest.requires?.capabilities ?? []).map((cap) => ({ cap, required: true })),
+      ...(manifest.optional?.capabilities ?? []).map((cap) => ({ cap, required: false })),
+    ];
+    for (const { cap, required } of consumed) {
       // Framework-granted privileges (e.g. cross_module_read) aren't
       // provider-backed — they're gated by the allow-list at import time,
       // not satisfied by deploying another module. Skip them here.
@@ -126,6 +133,7 @@ export async function runPreflight(
         .where(eq(capabilities.capabilityName, cap.name))
         .all();
       if (providers.length === 0) {
+        if (!required) continue;
         errors.push({
           category: 'missing-capability',
           message: `Required capability '${cap.name}' has no provider installed`,
@@ -154,7 +162,8 @@ export async function runPreflight(
       errors.push({
         category: 'capability-version-mismatch',
         message:
-          `Module '${moduleId}' requires ${cap.name}@${cap.version} but ` +
+          `Module '${moduleId}' ${required ? 'requires' : 'optionally uses'} ` +
+          `${cap.name}@${cap.version} but ` +
           `provider '${example.moduleId}' offers ${cap.name}@${example.version}`,
         suggestion:
           reason === 'caller_minor_too_old'

package/src/services/deploy-validation.test.ts

@@ -19,15 +19,19 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { type DbClient, getDb } from '../db/client';
-import { modules, secrets } from '../db/schema';
+import { capabilities, modules, secrets } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
 import { resetTestDbPath } from '../test-utils/db-path';
 import { findMissingSecrets } from './config-interview';
-import { findMissingBuildArtifacts, findMissingRequiredVariables } from './deploy-validation';
+import {
+  findMissingBuildArtifacts,
+  findMissingRequiredVariables,
+  validateAndPrepareDeployment,
+} from './deploy-validation';
 
 function manifestWithStringMapSecret(): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'testmod',
     name: 'Test Module',
     version: '1.0.0',
@@ -50,7 +54,7 @@ function manifestWithStringMapSecret(): ModuleManifest {
 
 function manifestWithPlainStringSecret(): ModuleManifest {
   return {
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'testmod',
     name: 'Test Module',
     version: '1.0.0',
@@ -136,7 +140,7 @@ describe('findMissingRequiredVariables (deploy path)', () => {
   // for the interview, and not as a deploy-blocking error.
   test('a source: hook variable is never reported missing, even required and unwritten', async () => {
     const manifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       variables: {
         owns: [
           {
@@ -337,7 +341,7 @@ describe('findMissingBuildArtifacts (deploy build-gate)', () => {
 
   function manifestWithArtifacts(artifacts: string[]): ModuleManifest {
     return {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'buildmod',
       name: 'Build Module',
       version: '1.0.0',
@@ -347,7 +351,7 @@ describe('findMissingBuildArtifacts (deploy build-gate)', () => {
   }
 
   test('returns [] when the module declares no build section', () => {
-    const manifest = { celilo_contract: '1.0', id: 'm', version: '1.0.0' } as ModuleManifest;
+    const manifest = { celilo_contract: '2.0', id: 'm', version: '1.0.0' } as ModuleManifest;
     expect(findMissingBuildArtifacts(manifest, dir)).toEqual([]);
   });
 
@@ -366,3 +370,78 @@ describe('findMissingBuildArtifacts (deploy build-gate)', () => {
     expect(findMissingBuildArtifacts(manifest, dir)).toEqual(['dist/index.html', 'dist/db.sqlite']);
   });
 });
+
+/**
+ * celilo#1384. An OPTIONAL capability is optional in its PRESENCE, not in its
+ * contract: with a provider installed the module's hooks call it, so a
+ * provider on another major fails at runtime — and `on_install` failing is
+ * only a warning, so it fails silently. Measured: generic-cpanel 0.4.1+2
+ * (external_web 2.0.0) against tango-nexus 0.8.0 (optional external_web
+ * 1.0.0); nothing published, the site kept serving, nothing said so.
+ */
+describe('validateAndPrepareDeployment (optional capability version gate)', () => {
+  let tempDir: string;
+  let db: DbClient;
+
+  function seed(optionalVersion: string, providerVersion: string | null) {
+    db.insert(modules)
+      .values({
+        id: 'consumer',
+        name: 'Consumer',
+        sourcePath: tempDir,
+        version: '1.0.0',
+        manifestData: {
+          celilo_contract: '2.0',
+          id: 'consumer',
+          name: 'Consumer',
+          version: '1.0.0',
+          description: 'fixture',
+          optional: { capabilities: [{ name: 'external_web', version: optionalVersion }] },
+        },
+      })
+      .run();
+    if (providerVersion === null) return;
+    db.insert(modules)
+      .values({
+        id: 'provider',
+        name: 'Provider',
+        sourcePath: tempDir,
+        version: '1.0.0',
+        manifestData: {},
+      })
+      .run();
+    db.insert(capabilities)
+      .values({
+        moduleId: 'provider',
+        capabilityName: 'external_web',
+        version: providerVersion,
+        data: {},
+      })
+      .run();
+  }
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-optional-cap-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    db = getDb();
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+    resetTestDbPath();
+  });
+
+  test('refuses the deploy when the installed provider is another major', async () => {
+    seed('1.0.0', '2.0.0');
+    const result = await validateAndPrepareDeployment('consumer', db);
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('external_web');
+    expect(result.error).toContain('provider');
+  });
+
+  test('does not refuse when nobody provides the optional capability', async () => {
+    seed('1.0.0', null);
+    const result = await validateAndPrepareDeployment('consumer', db);
+    expect(result.error).toBeUndefined();
+  });
+});

package/src/services/deploy-validation.ts

@@ -113,6 +113,25 @@ export async function validateAndPrepareDeployment(
     }
   }
 
+  // An OPTIONAL capability is optional in its PRESENCE, not in its contract.
+  // When a provider is installed the module's hooks will call it, so a provider
+  // on another major breaks at runtime exactly as a required one would — except
+  // an `on_install` failure is only a warning, so it breaks silently
+  // (celilo#1384). No provider installed is still fine: the version check below
+  // skips a capability nobody provides.
+  if (manifest.optional?.capabilities) {
+    const optionalMismatches = await findCapabilityVersionMismatches(
+      manifest.optional.capabilities,
+      db,
+    );
+    if (optionalMismatches.length > 0) {
+      return {
+        success: false,
+        error: formatVersionMismatchError(moduleId, optionalMismatches),
+      };
+    }
+  }
+
   // Check for missing required variables BEFORE generating — if any are missing
   // we return them for the caller to interview, then the caller re-invokes deploy
   // after the user has answered. This prevents generation from failing mid-way

package/src/services/dns-provider-backfill.test.ts

@@ -42,7 +42,7 @@ describe('backfillWebRouteDns (ISS-0029)', () => {
         id,
         name: id,
         version: '1.0.0',
-        manifestData: { id, name: id, version: '1.0.0', celilo_contract: '1.0' },
+        manifestData: { id, name: id, version: '1.0.0', celilo_contract: '2.0' },
         sourcePath: `/tmp/${id}`,
       })
       .run();
@@ -73,7 +73,7 @@ describe('backfillWebRouteDns (ISS-0029)', () => {
         id: 'caddy',
         name: 'caddy',
         version: '1.0.0',
-        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '1.0' },
+        manifestData: { id: 'caddy', name: 'caddy', version: '1.0.0', celilo_contract: '2.0' },
         sourcePath: '/tmp/caddy',
       })
       .onConflictDoNothing()

package/src/services/dns-registrations.test.ts

@@ -37,7 +37,7 @@ describe('dns_registrations ledger', () => {
           name: id,
           sourcePath: join(tempDir, id),
           version: '1.0.0',
-          manifestData: { celilo_contract: '1.0', id, name: id, version: '1.0.0' },
+          manifestData: { celilo_contract: '2.0', id, name: id, version: '1.0.0' },
         })
         .run();
     }

package/src/services/fleet-checks.test.ts

@@ -70,7 +70,7 @@ function installFakeUnit(home: string, scope: 'user' | 'system' = 'user', system
 }
 
 const baseManifest = (overrides: Partial<ModuleManifest> = {}): ModuleManifest => ({
-  celilo_contract: '1.0',
+  celilo_contract: '2.0',
   id: 'mod',
   name: 'Mod',
   version: '1.0.0',
@@ -340,7 +340,7 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
       writeFileSync(
         join(src, 'manifest.yml'),
         [
-          'celilo_contract: "1.0"',
+          'celilo_contract: "2.0"',
           `id: ${id}`,
           `name: ${id}`,
           'version: 1.0.0',

package/src/services/fleet-checks.ts

@@ -19,7 +19,7 @@
 
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { type Bus, describeError } from '@celilo/event-bus';
+import { type Bus, type BusHealth, describeError } from '@celilo/event-bus';
 import { desc, eq, inArray } from 'drizzle-orm';
 import { parse as parseYaml } from 'yaml';
 import { ProxmoxClient, type ProxmoxCredentials } from '../api-clients/proxmox';
@@ -203,6 +203,12 @@ export interface DispatcherCheckOptions {
    * Injected so the crash-loop aspect is testable without launchd.
    */
   launchdProbe?: (scope: SupervisorScope) => LaunchdUnitStatus | null;
+  /**
+   * A verdict already taken, normally `await bus.healthConfirmed()`. Callers
+   * that can await pass it so a load-starved dispatcher reads `lagging` rather
+   * than the `wedged` a single sample cannot distinguish it from (celilo#1399).
+   */
+  health?: BusHealth;
 }
 
 /**
@@ -214,7 +220,7 @@ export interface DispatcherCheckOptions {
  */
 export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): FleetFinding {
   const now = opts.now ?? Date.now();
-  const health = bus.health();
+  const health = opts.health ?? bus.health();
   const hb = bus.db
     .query<HeartbeatRow, []>(
       'SELECT dispatcher_id, last_heartbeat, started_at, pid, version FROM dispatcher_heartbeat ORDER BY last_heartbeat DESC LIMIT 1',
@@ -227,14 +233,25 @@ export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): Fl
 
   // (1) running — a fresh heartbeat. health() already classifies a
   // stale/absent heartbeat as no_dispatcher.
-  if (health.status === 'no_dispatcher' || !hb) {
+  if (health.status === 'no_dispatcher' || health.status === 'wedged' || !hb) {
     statuses.push('fail');
-    detail.push(
-      'no live dispatcher — heartbeat absent or stale (events are queueing, not delivered)',
-    );
-    remediations.push(
-      'start the dispatcher: `systemctl --user enable --now celilo-events.service` (or `celilo events install-daemon` then enable it)',
-    );
+    if (health.status === 'wedged') {
+      // Registered, process alive, heartbeat stale, nothing running: it is present
+      // but dead, so "start the dispatcher" is the wrong instruction (celilo#1398).
+      detail.push(
+        `dispatcher WEDGED — pid ${hb?.pid ?? '?'} is alive and registered but its heartbeat is ${Math.round((health.lastHeartbeatAgeMs ?? 0) / 1000)}s old with nothing running (events are queueing, not delivered)`,
+      );
+      remediations.push(
+        health.remedy ?? 'restart the dispatcher: `celilo events restart-daemon --system`',
+      );
+    } else {
+      detail.push(
+        'no live dispatcher — heartbeat absent or stale (events are queueing, not delivered)',
+      );
+      remediations.push(
+        'start the dispatcher: `systemctl --user enable --now celilo-events.service` (or `celilo events install-daemon` then enable it)',
+      );
+    }
     // A unit can be INSTALLED and still dead: the supervisor respawns a
     // program that cannot start in the unit's environment and it dies again,
     // forever. On macOS the classic cause is a PATH-less
@@ -274,6 +291,15 @@ export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): Fl
   detail.push(
     `running (pid ${hb.pid}, heartbeat ${Math.round(ageMs / 1000)}s ago, code v${hb.version})`,
   );
+  if (health.status === 'lagging') {
+    // Confirmed alive by a second beat: slow, not dead. Worth saying — an operator
+    // reading a 60s heartbeat wants to know it was checked — but not a failure,
+    // and explicitly not a restart (celilo#1399).
+    statuses.push('warn');
+    detail.push(
+      'heartbeat is stale but still advancing — the dispatcher is alive and starved for CPU, not wedged; it recovers when load drops',
+    );
+  }
   if (health.status === 'stuck') {
     statuses.push('warn');
     detail.push(
@@ -1395,7 +1421,11 @@ export async function runFleetChecks(
   const hostLiveness = opts.hostLiveness ?? (() => collectHostLiveness(db));
   return [
     checkSchemaDrift(db),
-    checkDispatcher(bus, { now: opts.now, installedCodeMtimeMs: opts.installedCodeMtimeMs }),
+    checkDispatcher(bus, {
+      now: opts.now,
+      installedCodeMtimeMs: opts.installedCodeMtimeMs,
+      health: await bus.healthConfirmed(),
+    }),
     checkBuildBusPublishing(bus, db, { now: opts.now }),
     checkSubscribers(bus, db),
     checkCapabilityProviders(db),

package/src/services/health-runner.test.ts

@@ -106,7 +106,7 @@ describe('runModuleHealthCheck — clearing a recorded failure (celilo#1363)', (
           state: 'ERROR',
           errorMessage: 'Upgrade to 1.0.0+6 failed to deploy: ssh: connection refused',
           manifestData: {
-            celilo_contract: '1.0',
+            celilo_contract: '2.0',
             id: 'celilo-mgmt',
             name: 'Control plane',
             version: '1.0.0',

package/src/services/infrastructure-variable-resolver.test.ts

@@ -59,7 +59,7 @@ describe('resolveInfrastructureVariables - Machine Infrastructure', () => {
 
     // Create manifest with infrastructure variables
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'DNS External',
       version: '1.0.0',
@@ -137,7 +137,7 @@ describe('resolveInfrastructureVariables - Machine Infrastructure', () => {
     const moduleId = 'test-module';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Test',
       version: '1.0.0',
@@ -203,7 +203,7 @@ describe('resolveInfrastructureVariables - Proxmox Container Service', () => {
     const moduleId = 'homebridge';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Homebridge',
       version: '1.0.0',
@@ -287,7 +287,7 @@ describe('resolveInfrastructureVariables - Proxmox Container Service', () => {
     const moduleId = 'test-module';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Test',
       version: '1.0.0',
@@ -350,7 +350,7 @@ describe('resolveInfrastructureVariables - Digital Ocean Container Service', ()
     const moduleId = 'dns-external';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'DNS External',
       version: '1.0.0',
@@ -436,7 +436,7 @@ describe('resolveInfrastructureVariables - User Override', () => {
     const moduleId = 'dns-external';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'DNS External',
       version: '1.0.0',
@@ -494,7 +494,7 @@ describe('resolveInfrastructureVariables - Required vs Optional', () => {
     const moduleId = 'test-module';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Test',
       version: '1.0.0',
@@ -544,7 +544,7 @@ describe('resolveInfrastructureVariables - Required vs Optional', () => {
     const moduleId = 'test-module';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Test',
       version: '1.0.0',
@@ -605,7 +605,7 @@ describe('resolveInfrastructureVariables - Required vs Optional', () => {
 describe('resolveInfrastructureVariables - Edge Cases', () => {
   test('returns empty when no infrastructure variables declared', async () => {
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'test-module',
       name: 'Test',
       version: '1.0.0',
@@ -632,7 +632,7 @@ describe('resolveInfrastructureVariables - Edge Cases', () => {
 
   test('throws when no infrastructure selected', async () => {
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: 'test-module',
       name: 'Test',
       version: '1.0.0',
@@ -660,7 +660,7 @@ describe('resolveInfrastructureVariables - Edge Cases', () => {
     const moduleId = 'test-module';
 
     const manifest: ModuleManifest = {
-      celilo_contract: '1.0',
+      celilo_contract: '2.0',
       id: moduleId,
       name: 'Test',
       version: '1.0.0',

package/src/services/instance-ops.test.ts

@@ -15,7 +15,7 @@ import { deriveInstanceModuleId } from './module-instances';
 
 const manifest = (over: Record<string, unknown> = {}): ModuleManifest =>
   ({
-    celilo_contract: '1.0',
+    celilo_contract: '2.0',
     id: 'lab',
     name: 'BYOI Lab',
     version: '1.0.0',
@@ -110,7 +110,7 @@ describe('createInstanceOps against a real database', () => {
   let parentPath: string;
 
   const SUBMODULE_YAML = `
-celilo_contract: "1.0"
+celilo_contract: "2.0"
 id: lab
 name: BYOI Lab
 version: 1.0.0

package/src/services/machine-interface-zones.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, test } from 'bun:test';
+import type { NetworkZone } from '../db/schema';
+import {
+  applyReclassification,
+  diffInterfaceZones,
+  explainMissingZoneInterface,
+} from './machine-interface-zones';
+
+/** The zone model as it stands today: 10.0.120.0/24 is secure-mgmt. */
+const detect = async (ip: string): Promise<NetworkZone | 'unknown'> => {
+  if (ip.startsWith('10.0.120.')) return 'secure-mgmt';
+  if (ip.startsWith('10.0.10.')) return 'dmz';
+  return 'unknown';
+};
+
+/**
+ * celilo-mgr as celilo#1382 found it: added before `secure-mgmt` existed,
+ * while the detector labelled unmatched subnets `external`.
+ */
+const celiloMgr = [{ name: 'eth0', ipAddress: '10.0.120.10', zone: 'external' }];
+
+describe('diffInterfaceZones', () => {
+  test('reports a label the current zone model disagrees with', async () => {
+    expect(await diffInterfaceZones(celiloMgr, detect)).toEqual([
+      { name: 'eth0', ipAddress: '10.0.120.10', from: 'external', to: 'secure-mgmt' },
+    ]);
+  });
+
+  test('reports nothing when the stored labels already agree', async () => {
+    const current = [{ name: 'eth0', ipAddress: '10.0.120.10', zone: 'secure-mgmt' }];
+    expect(await diffInterfaceZones(current, detect)).toEqual([]);
+  });
+
+  test('reports only the interfaces that changed', async () => {
+    const mixed = [
+      { name: 'eth0', ipAddress: '10.0.120.10', zone: 'external' },
+      { name: 'eth1', ipAddress: '10.0.10.5', zone: 'dmz' },
+    ];
+    const changes = await diffInterfaceZones(mixed, detect);
+    expect(changes.map((c) => c.name)).toEqual(['eth0']);
+  });
+});
+
+describe('applyReclassification', () => {
+  test('writes the new label and leaves the input untouched', async () => {
+    const changes = await diffInterfaceZones(celiloMgr, detect);
+    expect(applyReclassification(celiloMgr, changes)).toEqual([
+      { name: 'eth0', ipAddress: '10.0.120.10', zone: 'secure-mgmt' },
+    ]);
+    expect(celiloMgr[0].zone).toBe('external');
+  });
+});
+
+describe('explainMissingZoneInterface', () => {
+  test('says MISLABELLED, and names the interface, when one would match', async () => {
+    const changes = await diffInterfaceZones(celiloMgr, detect);
+    const message = explainMissingZoneInterface(celiloMgr, 'secure-mgmt', changes);
+    expect(message).toContain('MISLABELLED');
+    expect(message).toContain('eth0');
+    expect(message).toContain('10.0.120.10');
+    expect(message).toContain('machine reclassify');
+  });
+
+  test('says the interface is absent when no relabel would produce one', async () => {
+    const dmzOnly = [{ name: 'eth0', ipAddress: '10.0.10.5', zone: 'dmz' }];
+    const changes = await diffInterfaceZones(dmzOnly, detect);
+    const message = explainMissingZoneInterface(dmzOnly, 'secure-mgmt', changes);
+    expect(message).toContain("has no interface in zone 'secure-mgmt'");
+    expect(message).not.toContain('MISLABELLED');
+    // Names what it DOES hold, so the operator can see why.
+    expect(message).toContain('10.0.10.5');
+  });
+});