@celilo/e2e 0.7.17 → 0.9.0

package/README.md

@@ -399,3 +399,29 @@ e2e/
     smoke.test.ts           # Basic connectivity verification
     ...
 ```
+
+## Suite health policy (e2e-confidence)
+
+The suite must never be tolerated as ambient-red — a regression hiding in chronic
+red is how the install-sh DNS-pollution bug survived for weeks. Two rules:
+
+- **No ambient red.** A flaky or failing test is either *fixed* or *quarantined
+  with a tracking issue*, never left standing-red. Quarantine by adding a
+  `cele2e-ci-unsafe` marker comment to the test file (with the issue id); the
+  nightly runs `--ci-safe`, which skips quarantined tests, so it stays green on
+  the supported set. `--complete` / `--all` run everything including quarantined.
+
+- **Randomized-order lane.** Order-dependent bugs (a test polluting shared infra
+  for a *later* test) pass in fixed order and solo. The weekly `cele2e-shuffle`
+  workflow runs `--ci-safe --shuffle` to flush them out. The shuffle is seeded
+  and the seed is logged; replay a failing order exactly with:
+
+  ```bash
+  cele2e run --ci-safe --shuffle --seed=<n>
+  ```
+
+Supporting guards (so a future bug is caught at the cause, not 15 tests later):
+the shared-DNS reset verifies its own postcondition, the namecheap-ddns sim
+refuses overwrites of protected seeded records, the runner names any test that
+leaves shared DNS polluted, and readiness waits attach live-state diagnostics on
+timeout instead of speculating.

package/bin/e2e-bake-management

@@ -1,18 +1,25 @@
 #!/usr/bin/env bun
 /**
- * Bake celilo into the management image by running install.sh against the
- * simulated celilo.computer + npm registry, then `docker commit` the
- * result onto the `celilo-e2e/management:latest` tag.
+ * Bake celilo into the management image, then `docker commit` the result
+ * onto the `celilo-e2e/management:latest` tag. Two modes:
+ *
+ *   (default)     Run install.sh against the simulated celilo.computer +
+ *                 npm registry, installing the monorepo DEV cli exactly the
+ *                 way users do. Exercises install.sh end-to-end.
+ *
+ *   --published   Install the PUBLISHED @celilo/cli from REAL npm in a
+ *                 standalone container on the default docker network. The
+ *                 simulated topology has no route to npmjs.org, so this
+ *                 path deliberately runs outside it. This is what a
+ *                 monorepo-free npm consumer actually gets (ce-fo6).
  *
  * Run as the last step of `cele2e build-infra`. After this:
  *   - celilo-e2e/management:vanilla — bun + unzip + bunfig (no celilo)
- *   - celilo-e2e/management:latest  — vanilla + celilo, provisioned via
- *                                     install.sh exactly the way users do
+ *   - celilo-e2e/management:latest  — vanilla + celilo
  *
- * If install.sh regresses, this step fails build-infra loudly with the
- * script's own output. Tests cannot mask the failure by accident — the
- * default management image they all use literally cannot be produced
- * without install.sh succeeding.
+ * If the install regresses, this step fails build-infra loudly. The CLI is
+ * verified AFTER the source-mount shim is written and with no /celilo mount,
+ * so a broken shim fallback can't ship green (ISS-0124).
  */
 
 import { execSync } from 'node:child_process';
@@ -20,12 +27,6 @@ import { join } from 'node:path';
 import { ensureSharedInfra } from '../src/shared-infra';
 import { network } from '../src/network-builder';
 
-// Absolute paths relative to this script — important because cwd at
-// invocation time can be either the monorepo root (./cele2e wrapper)
-// or the package root (./cele2e build-infra after the wrapper cd's
-// into packages/e2e). Hardcoding a relative path was a real bug
-// (`packages/e2e/packages/e2e/...` doubling when cwd was already the
-// package dir) and showed up as a silent bake failure.
 const PACKAGE_ROOT = join(import.meta.dir, '..');
 const COMPOSE_FILE = join(PACKAGE_ROOT, 'docker-compose.test.yml');
 
@@ -33,42 +34,106 @@ function run(cmd: string): string {
   return execSync(cmd, { stdio: 'pipe', encoding: 'utf-8' });
 }
 
-async function main(): Promise<void> {
+interface ExecResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+type Exec = (cmd: string, timeoutMs?: number) => Promise<ExecResult>;
+
+/**
+ * Write the source-mount dev-loop shim to /usr/local/bin/celilo and verify
+ * the CLI works through it. Shared by both bake modes.
+ *
+ * The shim (at /usr/local/bin/celilo so plain `docker exec bash -c celilo`
+ * finds it) prefers a mounted /celilo workspace, else falls through to the
+ * real installed CLI at /root/.bun/bin/celilo. Two things must hold, both
+ * bitten in ISS-0124:
+ *
+ *  1. `bun add -g` links the celilo binary at /usr/local/bin/celilo as a
+ *     SYMLINK into the package (bun's global bin dir in this image is
+ *     /usr/local/bin, where bun itself lives). Writing the shim with
+ *     `> /usr/local/bin/celilo` would follow that symlink and clobber the
+ *     package's OWN launcher — turning the fallback into an infinite loop.
+ *     So we `rm -f` the symlink first and write a fresh regular file.
+ *  2. The fallback target /root/.bun/bin/celilo doesn't exist after a
+ *     /usr/local/bin install, so we point a guaranteed symlink at the
+ *     package launcher first. Guarded so an image where bun genuinely
+ *     lives under /root/.bun is left untouched.
+ *
+ * Verify runs AFTER the shim and with NO /celilo mount — i.e. exactly the
+ * shipped path — so a dangling/looping fallback fails the bake instead of
+ * shipping green.
+ */
+async function installShimAndVerify(exec: Exec, label: string): Promise<void> {
+  process.stdout.write('  source-mount shim ...... ');
+  const t0 = Date.now();
+  const shim = [
+    '#!/bin/bash',
+    'if [ -d /celilo/apps/celilo ]; then',
+    '  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"',
+    'fi',
+    'exec /root/.bun/bin/celilo "$@"',
+  ].join('\n');
+  const shimBase64 = Buffer.from(shim).toString('base64');
+  const shimResult = await exec(
+    'mkdir -p /root/.bun/bin && ' +
+      '{ [ -e /root/.bun/bin/celilo ] || ' +
+      'ln -s /root/.bun/install/global/node_modules/@celilo/cli/bin/celilo /root/.bun/bin/celilo; } && ' +
+      'rm -f /usr/local/bin/celilo && ' +
+      `echo ${shimBase64} | base64 -d > /usr/local/bin/celilo && chmod +x /usr/local/bin/celilo`,
+  );
+  if (shimResult.exitCode !== 0) {
+    throw new Error(`Shim install failed: ${shimResult.stderr}`);
+  }
+  console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
+
+  process.stdout.write('  verify celilo --version  ');
+  const t1 = Date.now();
+  const verify = await exec('celilo --version 2>&1');
+  if (verify.exitCode !== 0) {
+    console.log(`✗ exit ${verify.exitCode}`);
+    console.error('--- celilo --version output ---');
+    console.error(verify.stdout);
+    console.error(verify.stderr);
+    throw new Error(
+      `celilo --version failed after shim (${label}) — image is broken (dangling shim fallback?)`,
+    );
+  }
+  console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s  (${verify.stdout.trim()})`);
+}
+
+/**
+ * Default bake: install.sh against the simulated celilo.computer / npm
+ * registry, inside the standard topology.
+ */
+async function bakeViaSim(): Promise<void> {
   console.log('▸ Baking celilo into management:latest via install.sh');
   console.log('');
 
-  // Step 1: shared infra (DNS, Pebble, simulators).
   process.stdout.write('  shared-infra ........... ');
   const t0 = Date.now();
   await ensureSharedInfra();
   console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
 
-  // Step 2: per-test stack with vanilla management. Default topology so
-  // celilo.computer resolution exercises fw-isp + fw-ext.
   process.stdout.write('  per-test stack ......... ');
   const t1 = Date.now();
-  const net = await network()
-    .topology('default')
-    .managementVariant('vanilla')
-    .start();
+  const net = await network().topology('default').managementVariant('vanilla').start();
   console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s  (${net.projectName})`);
 
+  const exec: Exec = (cmd, timeoutMs) => net.exec('management', cmd, timeoutMs);
+
   let containerId = '';
   try {
-    // Step 2.5: wait for the management container's Pebble CA fetch to
-    // complete. management-routes.sh kicks off the Pebble runtime-root
-    // download in the background; if install.sh runs before that
-    // finishes, curl fails on TLS and (without pipefail) the
-    // curl-pipe-bash exits 0 silently — install.sh "ran" in 0s and
-    // no celilo gets installed. We poll an actual HTTPS GET to
-    // celilo.computer to confirm the cert chain is verifiable from
-    // inside the container.
+    // Wait for the management container's Pebble CA fetch to complete so
+    // the curl-pipe-bash below can verify TLS to celilo.computer. Without
+    // pipefail an early curl failure returns 0 silently and install.sh
+    // "runs" in 0s installing nothing.
     process.stdout.write('  pebble CA ready .......... ');
     const tCa = Date.now();
     let caReady = false;
     for (let i = 0; i < 30; i++) {
-      const probe = await net.exec(
-        'management',
+      const probe = await exec(
         'curl -fsSL --max-time 3 https://celilo.computer/install.sh -o /dev/null 2>&1',
         5_000,
       );
@@ -86,15 +151,9 @@ async function main(): Promise<void> {
     }
     console.log(`✔ ${Math.round((Date.now() - tCa) / 1000)}s`);
 
-    // Step 3: run install.sh inside the vanilla management container.
-    // install.sh is non-interactive by default (post commit 1d5f2c1) —
-    // no flags needed. `set -o pipefail` is critical: without it, a
-    // curl failure (TLS, network, etc.) returns bash's empty-stdin
-    // exit (0) and we silently "succeed" without installing anything.
     process.stdout.write('  install.sh ............. ');
     const t2 = Date.now();
-    const result = await net.exec(
-      'management',
+    const result = await exec(
       'set -o pipefail; curl -fsSL https://celilo.computer/install.sh | bash 2>&1',
       180_000,
     );
@@ -107,50 +166,9 @@ async function main(): Promise<void> {
     }
     console.log(`✔ ${Math.round((Date.now() - t2) / 1000)}s`);
 
-    // Step 4: verify celilo --version actually works after install. This
-    // is the difference between "we observed install.sh exit 0" and "we
-    // confirmed install.sh produced a working celilo." Using bash -lc so
-    // /root/.bashrc's PATH munging takes effect, mirroring the real-user
-    // experience after install.
-    process.stdout.write('  verify celilo --version  ');
-    const t3 = Date.now();
-    const verify = await net.exec('management', 'bash -lc "celilo --version" 2>&1');
-    if (verify.exitCode !== 0) {
-      console.log(`✗ exit ${verify.exitCode}`);
-      console.error('--- celilo --version output ---');
-      console.error(verify.stdout);
-      console.error(verify.stderr);
-      throw new Error('celilo --version failed after install.sh — install is broken');
-    }
-    console.log(`✔ ${Math.round((Date.now() - t3) / 1000)}s`);
-
-    // Step 5: install the source-mount shim so the dev loop (mount
-    // /celilo into a running test) keeps working — same shim the old
-    // Dockerfile.management baked in. Done at runtime here so install.sh
-    // owns the canonical celilo path; the shim is purely a dev
-    // convenience layered on top. The shim sits at /usr/local/bin/celilo
-    // so non-login shells (i.e. plain `docker exec bash -c "celilo …"`,
-    // which is what `net.celilo()` does) find it on default PATH.
-    process.stdout.write('  source-mount shim ...... ');
-    const t4 = Date.now();
-    const shim = [
-      '#!/bin/bash',
-      'if [ -d /celilo/apps/celilo ]; then',
-      '  exec bun run /celilo/apps/celilo/src/cli/index.ts "$@"',
-      'fi',
-      'exec /root/.bun/bin/celilo "$@"',
-    ].join('\n');
-    const shimBase64 = Buffer.from(shim).toString('base64');
-    const shimResult = await net.exec(
-      'management',
-      `echo ${shimBase64} | base64 -d > /usr/local/bin/celilo && chmod +x /usr/local/bin/celilo`,
-    );
-    if (shimResult.exitCode !== 0) {
-      throw new Error(`Shim install failed: ${shimResult.stderr}`);
-    }
-    console.log(`✔ ${Math.round((Date.now() - t4) / 1000)}s`);
+    // Shim + verify (verify is post-shim, no mount — the shipped path).
+    await installShimAndVerify(exec, 'sim');
 
-    // Step 6: docker commit the baked container onto the :latest tag.
     process.stdout.write('  docker commit .......... ');
     const t5 = Date.now();
     containerId = run(
@@ -163,15 +181,126 @@ async function main(): Promise<void> {
     console.log(`✔ ${Math.round((Date.now() - t5) / 1000)}s`);
   } finally {
     process.stdout.write('  tearing down ........... ');
-    const t5 = Date.now();
+    const tDown = Date.now();
     await net.stop();
-    console.log(`✔ ${Math.round((Date.now() - t5) / 1000)}s`);
+    console.log(`✔ ${Math.round((Date.now() - tDown) / 1000)}s`);
   }
 
   console.log('');
   console.log('✓ celilo-e2e/management:latest baked from install.sh');
 }
 
+/**
+ * Published bake: install the PUBLISHED @celilo/cli from REAL npm in a
+ * standalone vanilla container on the default docker network (real
+ * internet). The simulated topology has no route to npmjs.org, so we run
+ * outside it.
+ */
+async function bakeViaPublished(): Promise<void> {
+  console.log('▸ Baking PUBLISHED @celilo/cli into management:latest from real npm');
+  console.log('');
+
+  const name = 'celilo-bake-published';
+  const dexec: Exec = (cmd) => {
+    try {
+      const stdout = execSync(`docker exec ${name} bash -c ${JSON.stringify(cmd)}`, {
+        stdio: 'pipe',
+        encoding: 'utf-8',
+      });
+      return Promise.resolve({ stdout, stderr: '', exitCode: 0 });
+    } catch (e: unknown) {
+      const err = e as { stdout?: Buffer; stderr?: Buffer; status?: number };
+      return Promise.resolve({
+        stdout: err.stdout?.toString() ?? '',
+        stderr: err.stderr?.toString() ?? '',
+        exitCode: err.status ?? 1,
+      });
+    }
+  };
+
+  // Fresh container every bake — a stale one may have half-applied global state.
+  try {
+    run(`docker rm -f ${name}`);
+  } catch {
+    // no stale container — fine
+  }
+
+  process.stdout.write('  start vanilla container  ');
+  const t0 = Date.now();
+  // Default bridge network → real internet (real npm, real DNS).
+  run(`docker run -d --name ${name} celilo-e2e/management:vanilla sleep infinity`);
+  console.log(`✔ ${Math.round((Date.now() - t0) / 1000)}s`);
+
+  try {
+    // Reset bun global state before installing from real npm:
+    //  - the @celilo scope override (bunfig) pins @celilo to the sim
+    //    registry (npm-registry.lab), unresolvable on the default bridge —
+    //    move it aside so `bun add -g` reaches real npm.
+    //  - a prior monorepo bake leaves bun.lock pinning @celilo tarball URLs
+    //    to the sim registry; every later `bun add -g` then dies with
+    //    FailedToOpenSocket regardless of cache clearing (ce-fo6). Nuke it.
+    process.stdout.write('  reset bun state ........ ');
+    const t1 = Date.now();
+    const reset = await dexec(
+      'mv /root/.bunfig.toml /root/.bunfig.toml.sim 2>/dev/null; ' +
+        'rm -f /root/.bun/install/global/bun.lock; true',
+    );
+    if (reset.exitCode !== 0) {
+      throw new Error(`Failed to reset bun state: ${reset.stderr}`);
+    }
+    console.log(`✔ ${Math.round((Date.now() - t1) / 1000)}s`);
+
+    process.stdout.write('  bun add -g (real npm) .. ');
+    const t2 = Date.now();
+    const add = await dexec(
+      'bun add -g @celilo/cli@alpha @celilo/event-bus@alpha @celilo/e2e@alpha 2>&1',
+    );
+    if (add.exitCode !== 0) {
+      console.log(`✗ exit ${add.exitCode}`);
+      console.error('--- bun add -g output ---');
+      console.error(add.stdout.slice(-3000));
+      console.error(add.stderr.slice(-2000));
+      throw new Error('bun add -g of published @celilo/* from real npm failed');
+    }
+    console.log(`✔ ${Math.round((Date.now() - t2) / 1000)}s`);
+
+    // Shim + verify (verify is post-shim, no mount — the shipped path).
+    await installShimAndVerify(dexec, 'published');
+
+    // Restore the sim @celilo scope override so the committed image is
+    // drop-in compatible with the simulated topology it runs tests in.
+    // ponytail: inert at test runtime (nothing re-fetches @celilo), kept
+    // only for parity with the sim-baked image.
+    await dexec('mv /root/.bunfig.toml.sim /root/.bunfig.toml 2>/dev/null; true');
+
+    process.stdout.write('  docker commit .......... ');
+    const t3 = Date.now();
+    run(`docker commit ${name} celilo-e2e/management:latest`);
+    console.log(`✔ ${Math.round((Date.now() - t3) / 1000)}s`);
+  } finally {
+    process.stdout.write('  removing container ..... ');
+    const t4 = Date.now();
+    try {
+      run(`docker rm -f ${name}`);
+    } catch {
+      // best-effort
+    }
+    console.log(`✔ ${Math.round((Date.now() - t4) / 1000)}s`);
+  }
+
+  console.log('');
+  console.log('✓ celilo-e2e/management:latest baked from PUBLISHED @celilo/cli');
+}
+
+async function main(): Promise<void> {
+  const published = process.argv.includes('--published');
+  if (published) {
+    await bakeViaPublished();
+  } else {
+    await bakeViaSim();
+  }
+}
+
 main().catch((err) => {
   console.error('');
   console.error(err);

package/config/routing/fw-main-routes.sh

@@ -8,22 +8,39 @@ chmod 700 /root/.ssh
 chmod 600 /root/.ssh/authorized_keys
 /usr/sbin/sshd
 
-# Routing — detect if we have an isp-external interface (direct-internet topology)
+# IP forwarding is set via sysctls in docker-compose
+iptables -P FORWARD ACCEPT
+
+# Routing + egress NAT — depends on topology (detected by the presence of an
+# isp-external interface).
 ip route del default 2>/dev/null || true
 if ip -o addr show | grep -q '100.100.0'; then
-  # Direct internet: route via fw-ext on isp-external
+  # Direct-internet: fw-main has its own external (WAN) interface.
   ip route add default via 100.100.0.101
+  # Egress NAT SCOPED to the external/WAN interface (the one with the public
+  # 100.100.0.x address) — NOT a blanket MASQUERADE (ISS-0156). Scoping to the WAN
+  # means inter-zone traffic (protected↔protected, protected↔internal) keeps its
+  # source, so the dmz-resident resolver sees each client's real zone for
+  # source-based DNS views. This boot-time rule is what target machines need for
+  # egress/DNS BEFORE any module deploys; celilo's iptables module applies the
+  # same WAN-scoped MASQUERADE on deploy (idempotent — the production code path).
+  EXT_IFACE=$(ip -o addr show | awk '/100\.100\.0\./{print $2; exit}')
+  iptables -t nat -A POSTROUTING -o "$EXT_IFACE" -j MASQUERADE
 else
-  # Default: route via fw-isp on internal
+  # Two-layer: no external interface on fw-main; it routes outbound to the
+  # upstream firewall (fw-isp) and MASQUERADEs toward it (egress leaves via the
+  # internal-facing interface, so there is no single WAN interface to scope to).
   ip route add default via 192.168.0.1
+  # Protected↔protected (dmz/app/secure ↔ each other, all in 10/8) is NOT NAT'd —
+  # a real firewall routes between its segmented zones without NAT, preserving the
+  # client source so the dmz-resident resolver can serve source-based split-horizon
+  # (ISS-0156). Only protected↔internal and egress get MASQUERADE'd below. Without
+  # this RETURN, app→dmz and internal→dmz would both be SNAT'd to the dmz gateway
+  # and become indistinguishable (confirmed via live probe).
+  iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 10.0.0.0/8 -j RETURN
+  iptables -t nat -A POSTROUTING -j MASQUERADE
 fi
 
-# IP forwarding is set via sysctls in docker-compose
-
-# NAT all outbound traffic from dmz/app/secure
-iptables -t nat -A POSTROUTING -j MASQUERADE
-iptables -P FORWARD ACCEPT
-
 # DNS
 echo "nameserver 100.100.0.1" > /etc/resolv.conf
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/e2e",
-  "version": "0.7.17",
+  "version": "0.9.0",
   "description": "E2E test infrastructure for Celilo-deployed applications. Provides a simulated internet with DNS hierarchy, ACME server, firewalls, and target machines in Docker.",
   "type": "module",
   "main": "./src/index.ts",
@@ -34,13 +34,11 @@
     "npm-registry-server/tsconfig.json",
     "npm-registry-server/src/",
     "scripts/",
-    "README.md",
-    "AGENTS.md",
-    "COVERAGE.md"
+    "README.md"
   ],
   "dependencies": {
     "@celilo/cli-display": "^0.1.9",
-    "@celilo/event-bus": "^0.1.7",
+    "@celilo/event-bus": "^0.1.8",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"
   },

package/simulators/namecheap-ddns/zone-updater.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from 'bun:test';
+import { isProtectedRecord, updateZone } from './zone-updater';
+
+describe('namecheap-ddns protected records (e2e-confidence #257)', () => {
+  test('celilo.computer apex + www are protected', () => {
+    expect(isProtectedRecord('celilo.computer', '@')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', '')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', 'celilo.computer')).toBe(true);
+    expect(isProtectedRecord('celilo.computer', 'www')).toBe(true);
+  });
+
+  test('customer DDNS hosts are NOT protected', () => {
+    // subdomains of the reserved domain are fine — only the seeded sim records
+    // are protected
+    expect(isProtectedRecord('celilo.computer', 'app')).toBe(false);
+    expect(isProtectedRecord('celilo.computer', 'dns-int.infra')).toBe(false);
+    // other domains are entirely customer-managed
+    expect(isProtectedRecord('iamtheinternet.org', '@')).toBe(false);
+    expect(isProtectedRecord('example.net', 'www')).toBe(false);
+  });
+
+  test('updateZone refuses a protected record before touching the filesystem', () => {
+    // The guard runs before any readFileSync, so this throws the protection
+    // error (not an ENOENT) even with no /config present — proving a DDNS apex
+    // clobber of the website-sim can never reach the zone file.
+    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(/reserved e2e infrastructure/);
+    expect(() => updateZone('celilo.computer', 'www', '100.64.0.1')).toThrow(
+      /reserved e2e infrastructure/,
+    );
+  });
+});

package/simulators/namecheap-ddns/zone-updater.ts

@@ -3,14 +3,40 @@ import { readFileSync, writeFileSync } from 'node:fs';
 
 const ZONE_DIR = '/config';
 
+/**
+ * Records that are reserved e2e infrastructure and must NEVER be mutated by a
+ * customer DDNS update — the website-sim's seeded names. A DDNS update with a
+ * NAT'd source IP once clobbered celilo.computer's apex off the website-sim
+ * (100.64.0.58 -> the fw-ext gateway 100.64.0.1), silently breaking install-sh
+ * for the rest of the suite. Also a real-operator footgun: a misbehaving DDNS
+ * client must not be able to overwrite a domain's apex/website record.
+ * (e2e-confidence #257.)
+ */
+const PROTECTED_RECORDS: Record<string, ReadonlySet<string>> = {
+  'celilo.computer': new Set(['@', '', 'celilo.computer', 'www']),
+};
+
+/** True if (domain, host) names a protected (seeded sim) record. */
+export function isProtectedRecord(domain: string, host: string): boolean {
+  return PROTECTED_RECORDS[domain]?.has(host) ?? false;
+}
+
 /**
  * Update an A record in a Knot zone file and reload.
  *
  * If the host already has an A record, it's replaced.
  * If not, a new one is appended before the end of the file.
  * The SOA serial is incremented on every update.
+ *
+ * Refuses to touch protected reserved-infrastructure records (PROTECTED_RECORDS).
  */
 export function updateZone(domain: string, host: string, ip: string): void {
+  if (isProtectedRecord(domain, host)) {
+    throw new Error(
+      `Refusing DDNS update to "${host}.${domain}": it is reserved e2e infrastructure ` +
+        `(the website-sim), not a DDNS-managed host (e2e-confidence #257).`,
+    );
+  }
   const zoneFile = `${ZONE_DIR}/${domain}.zone`;
   let content = readFileSync(zoneFile, 'utf-8');
 

package/src/cli/build.test.ts

@@ -0,0 +1,47 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { stageNetappsFromRegistry } from './build';
+
+let dir: string;
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'netapps-'));
+  process.env.CELILO_REGISTRY_URL = 'https://example.test/registry/';
+});
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+  rmSync(dir, { recursive: true, force: true });
+  process.env.CELILO_REGISTRY_URL = undefined;
+});
+
+test('fetches each module latest version to <name>.netapp via the download endpoint', async () => {
+  const seen: string[] = [];
+  // @ts-expect-error — minimal fetch stub for the two shapes we call.
+  globalThis.fetch = async (url: string) => {
+    seen.push(url);
+    if (url.includes('/api/v1/modules?')) {
+      return new Response(
+        JSON.stringify({
+          modules: [
+            { name: 'caddy', max_version: '1.2.3' },
+            { name: 'namecheap', max_version: '0.4.0' },
+          ],
+        }),
+      );
+    }
+    return new Response(new Uint8Array([1, 2, 3]));
+  };
+
+  await stageNetappsFromRegistry(dir);
+
+  expect(readdirSync(dir).sort()).toEqual(['caddy.netapp', 'namecheap.netapp']);
+  expect(existsSync(join(dir, 'caddy.netapp'))).toBe(true);
+  expect([...readFileSync(join(dir, 'caddy.netapp'))]).toEqual([1, 2, 3]);
+  // Trailing slash stripped; download hits the module's max_version.
+  expect(seen).toContain('https://example.test/registry/api/v1/modules/caddy/1.2.3/download');
+  expect(seen).toContain('https://example.test/registry/api/v1/modules/namecheap/0.4.0/download');
+});