@celilo/e2e 0.10.4 → 0.11.1

package/src/observer.ts

@@ -45,8 +45,8 @@ export interface ObserverPlacement {
 // — the firewall to the segmented zones — NOT the LAN's default route, which is the home
 // router below. A faithful internalDevice routes its default via the home router and has
 // NO route to the segmented zones, so a dmz/app/secure container IP is unreachable.
-const HOME_ROUTER = '192.168.0.1';
-const INTERNAL_RESOLVER = '192.168.0.10';
+const HOME_ROUTER = '10.226.1.1';
+const INTERNAL_RESOLVER = '10.226.1.10';
 const PUBLIC_RESOLVER = '100.100.0.1';
 const INTERNET_GATEWAY = '100.64.0.1'; // fw-ext, on internet-external
 
@@ -64,7 +64,7 @@ export const OBSERVER_PLACEMENTS: Record<Exclude<Vantage, 'management'>, Observe
   internalDevice: {
     service: 'observer-internal',
     network: 'internal',
-    ip: '192.168.0.211', // a LAN host (dhcp range is .200-.220; dhcp-client is .210)
+    ip: '10.226.1.211', // a LAN host (dhcp range is .200-.220; dhcp-client is .210)
     gateway: HOME_ROUTER,
     interZoneRoutes: false,
     // Identical DNS to the management box on purpose: the only difference vs management
@@ -109,7 +109,9 @@ export const OBSERVER_PLACEMENTS: Record<Exclude<Vantage, 'management'>, Observe
 /** The placement for an injectable vantage; throws for `management` (not injectable). */
 export function observerPlacement(vantage: Vantage): ObserverPlacement {
   if (vantage === 'management') {
-    throw new Error('management has no observer placement — it reuses the real management container.');
+    throw new Error(
+      'management has no observer placement — it reuses the real management container.',
+    );
   }
   return OBSERVER_PLACEMENTS[vantage];
 }
@@ -209,7 +211,10 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
         `timeout 4 bash -c 'exec 3<>/dev/tcp/${opts.host}/${opts.port}'`,
         8_000,
       );
-      return { connected: res.exitCode === 0, detail: res.exitCode === 0 ? undefined : 'connect failed/timed out' };
+      return {
+        connected: res.exitCode === 0,
+        detail: res.exitCode === 0 ? undefined : 'connect failed/timed out',
+      };
     },
 
     async ping(opts) {
@@ -223,8 +228,7 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
       const { host, port } = hostPort(opts.url);
       const certRes = await handle.exec(
         c,
-        `echo | openssl s_client -connect ${host}:${port} -servername ${host} 2>/dev/null | ` +
-          'openssl x509 -noout -subject -issuer -ext subjectAltName',
+        `echo | openssl s_client -connect ${host}:${port} -servername ${host} 2>/dev/null | openssl x509 -noout -subject -issuer -ext subjectAltName`,
         10_000,
       );
       // -k gathers the status even for an untrusted chain; the cert is reported truthfully
@@ -249,7 +253,10 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
       const hosts = await handle.exec(c, `grep -F ${opts.name} /etc/hosts`, 5_000);
       return {
         resolvConf: resolv.stdout.trim(),
-        hostsLines: hosts.stdout.split('\n').map((l) => l.trim()).filter(Boolean),
+        hostsLines: hosts.stdout
+          .split('\n')
+          .map((l) => l.trim())
+          .filter(Boolean),
       };
     },
   };

package/src/registry-bundle.ts

@@ -39,9 +39,7 @@ export function ensureRegistryServerBundle(pkgDir: string): void {
   if (!existsSync(upstream)) {
     if (!existsSync(bundle)) {
       throw new Error(
-        `cele2e: ${bundle} is missing and ../registry-server doesn't exist either.\n` +
-          'The @celilo/e2e package was published without its registry-server bundle. ' +
-          'Re-publish from infra/scripts/publish.ts so the bundle is recreated.',
+        `cele2e: ${bundle} is missing and ../registry-server doesn't exist either.\nThe @celilo/e2e package was published without its registry-server bundle. Re-publish from infra/scripts/publish.ts so the bundle is recreated.`,
       );
     }
     return; // npm-installed; bundle ships in tarball

package/src/run-lock.test.ts

@@ -3,10 +3,10 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { hostname, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
-  acquireRunLock,
-  clearLock,
   E2eBusyError,
   type LockHolder,
+  acquireRunLock,
+  clearLock,
   lockStatus,
   markKept,
   readHolder,

package/src/run-lock.ts

@@ -24,7 +24,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { mkdirSync, openSync, closeSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { closeSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, hostname } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 
@@ -71,7 +71,10 @@ export class E2eBusyError extends Error {
 export function formatBusy(h: LockHolder): string {
   const age = ageString(Date.parse(h.startedAt));
   const verb = h.state === 'kept' ? 'holds a kept stack from' : 'running';
-  const what = h.state === 'kept' ? `(run \`cele2e release\` to free it)` : `${h.test}, started ${age} ago (pid ${h.pid})`;
+  const what =
+    h.state === 'kept'
+      ? '(run `cele2e release` to free it)'
+      : `${h.test}, started ${age} ago (pid ${h.pid})`;
   return `e2e busy: ${h.session} ${verb} ${what}`;
 }
 
@@ -88,7 +91,11 @@ function deriveSession(): string {
   const cwd = process.cwd();
   const git = (args: string[]): string => {
     try {
-      return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      return execFileSync('git', args, {
+        cwd,
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
     } catch {
       return '';
     }
@@ -164,7 +171,9 @@ export function acquireRunLock(opts: { test: string; runId: string; allowKept?:
       // Reclaim when: corrupt/unreadable, the holder is stale, OR this is a
       // `--reuse` run taking over a `kept` stack it's deliberately reusing.
       if (!existing || isStale(existing) || (opts.allowKept && existing.state === 'kept')) {
-        try { unlinkSync(lockPath()); } catch {}
+        try {
+          unlinkSync(lockPath());
+        } catch {}
         continue;
       }
       throw new E2eBusyError(existing);
@@ -224,7 +233,12 @@ export function releaseRunLock(): void {
   if (held.keepOnRelease) {
     const cur = readHolder();
     if (cur && cur.pid === process.pid) {
-      try { writeFileSync(lockPath(), JSON.stringify({ ...cur, state: 'kept', beatAt: Date.now() }, null, 2)); } catch {}
+      try {
+        writeFileSync(
+          lockPath(),
+          JSON.stringify({ ...cur, state: 'kept', beatAt: Date.now() }, null, 2),
+        );
+      } catch {}
     }
     return;
   }

package/src/runner.ts

@@ -29,6 +29,7 @@ import {
   emitTestCompleted,
   emitTestStarted,
 } from './bus-events';
+import { extractFailureMessage, stripAnsi } from './extract-failure';
 import { parseLine } from './parse-line';
 import { E2eBusyError, acquireRunLock, markKept } from './run-lock';
 import { SIMULATOR_IPS } from './simulator-ips';
@@ -176,7 +177,7 @@ function loadTiming(): TimingHistory {
 }
 
 function saveTiming(history: TimingHistory): void {
-  writeFileSync(timingFile, JSON.stringify(history, Object.keys(history).sort(), 2) + '\n');
+  writeFileSync(timingFile, `${JSON.stringify(history, Object.keys(history).sort(), 2)}\n`);
 }
 
 function formatDuration(secs: number): string {
@@ -185,67 +186,8 @@ function formatDuration(secs: number): string {
 }
 
 // ─── Error Extraction ────────────────────────────────────────────────
-
-// Strips ANSI escape sequences so pattern matching works on bun's coloured output
-const ANSI_RE = /\x1b\[[0-9;]*m/g;
-function stripAnsi(s: string): string {
-  return s.replace(ANSI_RE, '');
-}
-
-function extractFailureMessage(lines: string[], exitCode: number): string {
-  const plain = lines.map(stripAnsi);
-
-  // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
-  const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
-  if (bunFailIdx >= 0) {
-    const testName = plain[bunFailIdx]
-      .replace(/^\s*✗\s+/, '')
-      .replace(/\s*\[\d+ms\].*$/, '')
-      .trim();
-    // Grab the error detail on the next few lines (bun indents it under the test)
-    const detail = plain
-      .slice(bunFailIdx + 1, bunFailIdx + 6)
-      .map((l) => l.trim())
-      .filter((l) => l.length > 0 && !l.startsWith('at ') && !l.startsWith('│') && l !== '└─')
-      .slice(0, 2)
-      .join(' — ');
-    return detail ? `${testName}: ${detail}` : testName;
-  }
-
-  // "error: ..." lines (may be indented in bun output)
-  const errorIdx = plain.findIndex(
-    (l) => l.trimStart().startsWith('error:') && !l.includes('bun test'),
-  );
-  if (errorIdx >= 0) {
-    const context = plain
-      .slice(errorIdx, errorIdx + 5)
-      .map((l) => l.trim())
-      .filter((l) => l.length > 0 && !l.startsWith('at '));
-    return context.join('\n    ');
-  }
-
-  const celiloError = plain.find(
-    (l) => l.includes('CeliloCommandError') || (l.includes('celilo') && l.includes('failed')),
-  );
-  if (celiloError) return celiloError.slice(0, 120);
-
-  const timeout = plain.find((l) => l.includes('Timeout') || l.includes('timed out'));
-  if (timeout) return timeout.slice(0, 120);
-
-  // Last resort: print the last few non-empty, non-progress lines from the output
-  const tail = plain
-    .filter(
-      (l) =>
-        l.length > 0 &&
-        !l.startsWith('[progress') &&
-        !l.startsWith('[e2e:') &&
-        !l.startsWith('[ansible:'),
-    )
-    .slice(-3)
-    .map((l) => l.trim())
-    .join(' | ');
-  return tail || `exit code ${exitCode}`;
-}
+// extractFailureMessage / stripAnsi live in extract-failure.ts: this file
+// calls main() at import time, so nothing declared here is testable.
 
 // ─── Test Execution ──────────────────────────────────────────────────
 
@@ -409,7 +351,7 @@ async function runTest(
         display.abandonFailed();
       }
 
-      writeFileSync(logFile, stdout + '\n---STDERR---\n' + stderr);
+      writeFileSync(logFile, `${stdout}\n---STDERR---\n${stderr}`);
 
       const expectMatch = stdout.match(/(\d+) expect\(\) calls/);
       const expectCount = expectMatch ? Number.parseInt(expectMatch[1], 10) : undefined;
@@ -816,7 +758,7 @@ async function main() {
     if (flagKeep && result.projectName) {
       writeFileSync(
         persistentFile,
-        JSON.stringify(
+        `${JSON.stringify(
           {
             projectName: result.projectName,
             testFile: file,
@@ -824,7 +766,7 @@ async function main() {
           },
           null,
           2,
-        ) + '\n',
+        )}\n`,
       );
       console.log(`${dim}  Persistent network: ${result.projectName}${reset}`);
       console.log(`${dim}  Reuse: ${basename(process.argv[1])} --reuse${reset}`);
@@ -886,7 +828,7 @@ async function main() {
     const icon = r.status === 'pass' ? '✓' : '✗';
     const color = r.status === 'pass' ? green : red;
     console.log(
-      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`,
+      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(`${r.duration}s`).padStart(6)}${reset}`,
     );
     if (r.error) {
       console.log(`${bold}║${reset}    ${red}└─ ${r.error}${reset}`);
@@ -911,7 +853,7 @@ async function main() {
   const adds: string[] = [];
   if (!content.includes('results/')) adds.push('results/');
   if (!content.includes('.e2e-timing.json')) adds.push('.e2e-timing.json');
-  if (adds.length) writeFileSync(gitignore, content.trimEnd() + '\n' + adds.join('\n') + '\n');
+  if (adds.length) writeFileSync(gitignore, `${content.trimEnd()}\n${adds.join('\n')}\n`);
 
   emitRunCompleted({
     runId,

package/src/shared-infra.ts

@@ -11,9 +11,13 @@
  */
 
 import { execSync } from 'node:child_process';
-import { join } from 'node:path';
 import { copyFileSync, existsSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { generateSharedInfraYaml, SHARED_PROJECT_NAME, SHARED_NETWORKS } from './docker-compose-generator';
+import { join } from 'node:path';
+import {
+  SHARED_NETWORKS,
+  SHARED_PROJECT_NAME,
+  generateSharedInfraYaml,
+} from './docker-compose-generator';
 import { ensureRegistryServerBundle } from './registry-bundle';
 
 const SHARED_COMPOSE_FILE = 'docker-compose.shared.yml';
@@ -37,8 +41,10 @@ function run(cmd: string, opts?: { cwd?: string; timeout?: number }): string {
  */
 function nukeE2eResources(e2eDir: string): void {
   try {
-    run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
-      { cwd: e2eDir, timeout: 30_000 });
+    run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
+      { cwd: e2eDir, timeout: 30_000 },
+    );
   } catch {}
   try {
     const ids = run('docker ps -aq --filter name=celilo-e2e', { timeout: 10_000 });
@@ -49,11 +55,17 @@ function nukeE2eResources(e2eDir: string): void {
       .split('\n')
       .filter((n) => n.startsWith('celilo-e2e'));
     for (const net of nets) {
-      try { run(`docker network rm ${net}`, { timeout: 5_000 }); } catch {}
+      try {
+        run(`docker network rm ${net}`, { timeout: 5_000 });
+      } catch {}
     }
   } catch {}
-  try { run('docker network prune -f', { timeout: 10_000 }); } catch {}
-  try { run('docker volume prune -f', { timeout: 10_000 }); } catch {}
+  try {
+    run('docker network prune -f', { timeout: 10_000 });
+  } catch {}
+  try {
+    run('docker volume prune -f', { timeout: 10_000 });
+  } catch {}
 }
 
 /**
@@ -117,7 +129,9 @@ export async function ensureSharedInfra(): Promise<void> {
       }
     } catch {
       // DNS check failed — restart shared infra
-      console.log('[progress:start] shared infra DNS check failed, restarting | shared infra restarted');
+      console.log(
+        '[progress:start] shared infra DNS check failed, restarting | shared infra restarted',
+      );
       await stopSharedInfra();
     }
   }
@@ -130,7 +144,9 @@ export async function ensureSharedInfra(): Promise<void> {
   // This self-heals orphans left by a crashed / cross-path / cross-checkout
   // prior run (e.g. a botched-mount container that wedges the next `up`),
   // which the old compose-project-scoped `down` couldn't see (#212).
-  console.log('[progress:start] cleaning up stale shared infrastructure | shared infra cleanup complete');
+  console.log(
+    '[progress:start] cleaning up stale shared infrastructure | shared infra cleanup complete',
+  );
   nukeE2eResources(e2eDir);
 
   // Refresh the bundled registry-server source so Dockerfile.registry's
@@ -161,12 +177,16 @@ export async function ensureSharedInfra(): Promise<void> {
 
   // Build and start
   console.log('[progress:start] building shared infrastructure images | shared images built');
-  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} build`,
-    { cwd: e2eDir, timeout: 300_000 });
+  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} build`, {
+    cwd: e2eDir,
+    timeout: 300_000,
+  });
 
   console.log('[progress:start] starting shared infrastructure | shared infra started');
-  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} up -d`,
-    { cwd: e2eDir, timeout: 120_000 });
+  run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} up -d`, {
+    cwd: e2eDir,
+    timeout: 120_000,
+  });
 
   // Wait for DNS convergence — robustly. The old single 60s window with no
   // recovery was an intermittent build-infra failure on the builder (#319:
@@ -196,23 +216,29 @@ export async function ensureSharedInfra(): Promise<void> {
     if (Date.now() - lastRestart > 45_000) {
       console.log('[progress:sub] DNS not converged yet — restarting namecheap-dns');
       try {
-        run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} restart namecheap-dns`,
-          { cwd: e2eDir, timeout: 30_000 });
+        run(
+          `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} restart namecheap-dns`,
+          { cwd: e2eDir, timeout: 30_000 },
+        );
       } catch {}
       lastRestart = Date.now();
     }
-    await new Promise(r => setTimeout(r, 2000));
+    await new Promise((r) => setTimeout(r, 2000));
   }
   // Diagnostics before failing, so the log shows WHY it didn't converge.
   let psOut = '';
   try {
-    psOut = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} ps`,
-      { cwd: e2eDir, timeout: 10_000 });
+    psOut = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} ps`, {
+      cwd: e2eDir,
+      timeout: 10_000,
+    });
   } catch {}
   let dnsLog = '';
   try {
-    dnsLog = run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} logs --tail 40 namecheap-dns`,
-      { cwd: e2eDir, timeout: 10_000 });
+    dnsLog = run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} logs --tail 40 namecheap-dns`,
+      { cwd: e2eDir, timeout: 10_000 },
+    );
   } catch {}
   throw new Error(
     `Timeout waiting for shared infrastructure DNS convergence (${dnsTimeout / 1000}s)\n` +
@@ -227,8 +253,10 @@ export async function stopSharedInfra(): Promise<void> {
   console.log('[progress:start] stopping shared infrastructure | shared infra stopped');
   const e2eDir = getE2eDir();
   try {
-    run(`docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
-      { cwd: e2eDir, timeout: 60_000 });
+    run(
+      `docker compose -f ${SHARED_COMPOSE_FILE} -p ${SHARED_PROJECT_NAME} down --volumes --remove-orphans`,
+      { cwd: e2eDir, timeout: 60_000 },
+    );
   } catch {
     // Best effort
   }

package/src/socks-proxy.ts

@@ -17,7 +17,7 @@ export interface SocksProxyOptions {
    *   ACME, Caddy host routing). Recommended for tests that need to
    *   simulate what a real user sees.
    * - 'internal': operator-on-LAN view, attaches to the internal zone,
-   *   uses split-horizon DNS (192.168.0.10) so iamtheinternet.org resolves
+   *   uses split-horizon DNS (10.226.1.10) so iamtheinternet.org resolves
    *   to caddy's internal IP directly. Useful for debugging — reaches all
    *   zones via the firewall.
    */
@@ -65,7 +65,7 @@ const VANTAGE_CONFIGS: Record<SocksProxyVantage, VantageConfig> = {
   },
   internal: {
     network: 'internal',
-    ip: '192.168.0.150',
+    ip: '10.226.1.150',
   },
 };
 
@@ -165,8 +165,7 @@ async function waitForTcpAccept(port: number, timeoutMs = 10_000): Promise<void>
     await new Promise((r) => setTimeout(r, 100));
   }
   throw new Error(
-    `SOCKS proxy on 127.0.0.1:${port} never accepted connections within ${timeoutMs}ms` +
-      (lastErr ? ` (last error: ${lastErr})` : ''),
+    `SOCKS proxy on 127.0.0.1:${port} never accepted connections within ${timeoutMs}ms${lastErr ? ` (last error: ${lastErr})` : ''}`,
   );
 }
 
@@ -233,8 +232,7 @@ function ensureProxyImage(): void {
   const dockerfilePath = join(PACKAGE_ROOT, PROXY_DOCKERFILE);
   if (!existsSync(dockerfilePath)) {
     throw new Error(
-      `SOCKS proxy Dockerfile not found at ${dockerfilePath}. ` +
-        `Expected it to ship with the @celilo/e2e package.`,
+      `SOCKS proxy Dockerfile not found at ${dockerfilePath}. Expected it to ship with the @celilo/e2e package.`,
     );
   }
 
@@ -247,18 +245,17 @@ function ensureProxyImage(): void {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Failed to build ${PROXY_IMAGE} from ${PROXY_DOCKERFILE}: ${msg}`,
-    );
+    throw new Error(`Failed to build ${PROXY_IMAGE} from ${PROXY_DOCKERFILE}: ${msg}`);
   }
 }
 
 function inspectContainer(name: string): boolean {
   try {
-    const result = execSync(
-      `docker inspect -f '{{.State.Running}}' ${name} 2>/dev/null`,
-      { timeout: 5_000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
-    );
+    const result = execSync(`docker inspect -f '{{.State.Running}}' ${name} 2>/dev/null`, {
+      timeout: 5_000,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
     return result.trim() === 'true';
   } catch {
     return false;
@@ -276,15 +273,15 @@ async function waitForContainerListening(name: string): Promise<void> {
   let lastInspect = '';
   while (Date.now() < deadline) {
     try {
-      lastInspect = execSync(
-        `docker inspect -f '{{.State.Status}} {{.State.ExitCode}}' ${name}`,
-        { timeout: 3_000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
-      ).trim();
+      lastInspect = execSync(`docker inspect -f '{{.State.Status}} {{.State.ExitCode}}' ${name}`, {
+        timeout: 3_000,
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
     } catch {
       // Container may have already self-removed (--rm) after exiting
       throw new Error(
-        `SOCKS proxy container '${name}' disappeared during startup. ` +
-          `It likely exited immediately. Check the image's required env vars.`,
+        `SOCKS proxy container '${name}' disappeared during startup. It likely exited immediately. Check the image's required env vars.`,
       );
     }
     const [status] = lastInspect.split(/\s+/);

package/src/types.ts

@@ -123,7 +123,7 @@ export interface NetworkConfig {
 
   /**
    * When set, brings up a SECOND management-class box named `celilo-mgr-2`
-   * (at 192.168.0.101 on `internal`) using the given image variant. Used by
+   * (at 10.226.1.101 on `internal`) using the given image variant. Used by
    * the migration restore e2e: the primary box is the backup source, the
    * second box is a fresh target that `apt install celilo` + `celilo restore`s
    * into. The second box is NOT auto-init'd by container-manager (which keys
@@ -355,7 +355,7 @@ export interface NetworkHandle {
    * subnets from ZONE_SUBNETS / ZONE_GATEWAYS.
    *
    * @param opts.zones - zones to provide (default: dmz, app, secure)
-   * @param opts.natIp - NAT IP for port-forwarded traffic (default 192.168.0.253)
+   * @param opts.natIp - NAT IP for port-forwarded traffic (default 10.226.1.253)
    */
   deployFirewall(opts?: {
     zones?: Array<'dmz' | 'app' | 'secure'>;
@@ -407,22 +407,72 @@ export interface ResponderValues {
   aspects?: Record<string, boolean>;
 }
 
-export const ZONE_GATEWAYS: Record<Zone, string> = {
-  dmz: '10.0.10.1',
-  app: '10.0.20.1',
-  secure: '10.0.30.1',
-  internal: '192.168.0.254',
-  'secure-mgmt': '10.0.120.1',
+/**
+ * The parent block every simulated PRIVATE zone lives inside (#539).
+ *
+ * The sim used to number its zones exactly like a real celilo fleet: its dmz,
+ * app and secure /24s WERE the fleet's, and its internal LAN was the operator's.
+ * That is not a cosmetic overlap — celilo's own forgejo-builder lives in the
+ * REAL dmz, so a leaked stack put a second interface on the builder's own /24
+ * and blackholed every containerized CI job's route to the forge for ~135s.
+ * Twice in one afternoon. Teardown can't be made reliable enough to fix that (a
+ * SIGKILL runs no handler), so the fix is that a leak stops MATTERING.
+ *
+ * `10.226.0.0/16` — mnemonic `0xE2` = "e2", the e2e supernet. It must be
+ * RFC-1918 (the private zones model private networks — CLAUDE.md inviolable
+ * rules #1/#3), and this block collides with nothing plausible:
+ *   - the fleet numbers its zones out of the bottom of 10/8   → far away
+ *   - the operator's VPN sits at the very top of 10/8         → far away
+ *   - the operator's LAN is in 192.168/16                     → different block
+ *   - Docker's default address pools are 172.16/12 and
+ *     192.168/16                                              → different block
+ *
+ * The second reason matters more than the collision: there must be nothing
+ * magic about the octets production happens to use. A suite that only passes on
+ * those exact numbers is asserting one site's address plan rather than celilo's
+ * behaviour. Renumbering proves address-independence.
+ *
+ * Do not move a zone out of this block. `address-plan.test.ts` fails if you do,
+ * and fails if the retired fleet-colliding prefixes reappear anywhere in the
+ * suite.
+ */
+export const SIM_PRIVATE_SUPERNET = '10.226.0.0/16';
+
+/**
+ * Third-octet plan inside {@link SIM_PRIVATE_SUPERNET}. Host octets are
+ * unchanged from the pre-#539 numbering, so `caddy` is still `…10.10` and
+ * fw-main is still `…1.254` — only the network part moved.
+ */
+const ZONE_PREFIXES: Record<Zone, string> = {
+  internal: '10.226.1',
+  dmz: '10.226.10',
+  app: '10.226.20',
+  secure: '10.226.30',
+  'secure-mgmt': '10.226.120',
 };
 
-export const ZONE_SUBNETS: Record<Zone, string> = {
-  dmz: '10.0.10.0/24',
-  app: '10.0.20.0/24',
-  secure: '10.0.30.0/24',
-  internal: '192.168.0.0/24',
-  'secure-mgmt': '10.0.120.0/24',
+/**
+ * An address in a zone, by host octet. Reference this instead of writing an
+ * octet: it is what makes the whole plan a one-line change, and what makes a
+ * stray hardcoded address stand out as the anomaly it is.
+ */
+export function zoneIp(zone: Zone, host: number): string {
+  return `${ZONE_PREFIXES[zone]}.${host}`;
+}
+
+/** The router/firewall leg in each zone. `internal`'s is fw-main's LAN side. */
+export const ZONE_GATEWAYS: Record<Zone, string> = {
+  dmz: zoneIp('dmz', 1),
+  app: zoneIp('app', 1),
+  secure: zoneIp('secure', 1),
+  internal: zoneIp('internal', 254),
+  'secure-mgmt': zoneIp('secure-mgmt', 1),
 };
 
+export const ZONE_SUBNETS: Record<Zone, string> = Object.fromEntries(
+  (Object.keys(ZONE_PREFIXES) as Zone[]).map((zone) => [zone, `${ZONE_PREFIXES[zone]}.0/24`]),
+) as Record<Zone, string>;
+
 /**
  * The firewall's internal-side DNAT ingress (the natIp) in the e2e topology — the role by
  * which an internal device reaches a service that lives in a segmented zone. Single source
@@ -431,7 +481,7 @@ export const ZONE_SUBNETS: Record<Zone, string> = {
  * hardcoding the address in a test.
  */
 export function internalNatIp(): string {
-  return '192.168.0.253';
+  return zoneIp('internal', 253);
 }
 
 /**
@@ -441,7 +491,7 @@ export function internalNatIp(): string {
  * this instead of hardcoding the address in a test.
  */
 export function greenwaveRouterIp(): string {
-  return '192.168.0.1';
+  return zoneIp('internal', 1);
 }
 
 /**
@@ -466,7 +516,7 @@ export function externalWanSubnet(): string {
 
 /** The internal split-horizon DNS resolver (dns-int) in the e2e topology. */
 export function internalResolverIp(): string {
-  return '192.168.0.10';
+  return zoneIp('internal', 10);
 }
 
 /** The public upstream recursive resolver (the comcast-resolver sim). */

package/src/vantage-helpers.ts

@@ -8,7 +8,7 @@
  * here — they wait on real firewall isolation (ISS-0118).
  *
  * Topology prerequisite: inject the observers the assertion needs, e.g.
- *   network().dmz({ caddy: '10.0.10.10' }).observe('internalDevice', 'publicInternet')
+ *   network().dmz({ caddy: '10.226.10.10' }).observe('internalDevice', 'publicInternet')
  */
 
 import { createObserverTransport } from './observer';
@@ -52,7 +52,11 @@ export async function assertFrontedServicePositives(
   const url = `https://${expectation.fqdn}${expectation.path ?? ''}`;
 
   // The internet sees the service at a public IP and a valid HTTPS endpoint.
-  await probe.assertResolvesInZone({ from: 'publicInternet', name: expectation.fqdn, zone: 'public' });
+  await probe.assertResolvesInZone({
+    from: 'publicInternet',
+    name: expectation.fqdn,
+    zone: 'public',
+  });
   await probe.assertHttps({
     from: 'publicInternet',
     url,