@underpostnet/cyberia 3.3.0 → 3.3.73

package/src/cli/test.js

@@ -1,174 +1,248 @@
 /**
- * Test module for running tests on the application.
+ * Runs the test tiers, wherever they have to run: on this host, inside a
+ * deployment's containers, or as a Job on the cluster.
+ *
+ * One entrypoint, one runner. Selecting suites, ordering tiers and rendering
+ * the reporting surfaces belong to `src/server/build/testing.js`; this module resolves
+ * where the run happens and drives it.
+ *
  * @module src/cli/test.js
  * @namespace UnderpostTest
  */
 
 import fs from 'fs-extra';
+import nodePath from 'node:path';
 import { timer } from '../client/components/core/CommonJs.js';
-import { MariaDB } from '../db/mariadb/MariaDB.js';
-import { getNpmRootPath } from '../server/environment.js';
-import { actionInitLog, loggerFactory, setUpInfo } from '../server/logger.js';
-import { pbcopy, shellExec } from '../server/process.js';
+import { getUnderpostRootPath } from '../server/runtime/environment.js';
+import { actionInitLog, loggerFactory, setUpInfo } from '../server/ops/logger.js';
+import { shellExec } from '../server/runtime/process.js';
+import {
+  UNDERPOST_TESTING,
+  allureManifestsFactory,
+  resolveTestSelection,
+  testJobManifestFactory,
+  vitestArgsFactory,
+} from '../server/build/testing.js';
 import Underpost from '../index.js';
+
 const logger = loggerFactory(import.meta);
 
 /**
  * @class UnderpostTest
- * @description Manages the test of the application.
+ * @description Manages test execution and its cluster-side reporting.
  * @memberof UnderpostTest
  */
 class UnderpostTest {
   static API = {
     /**
-     * Logs information about the current process environment to the console.
-     *
-     * This function is used to log details about
-     * the execution context, such as command-line arguments,
-     * environment variables, the process's administrative privileges,
-     * and the maximum available heap space size.
-     *
-     * @static
      * @method setUpInfo
+     * @description Logs the execution context a failing run has to be read against:
+     * arguments, environment, privileges and heap ceiling.
      * @returns {Promise<void>}
      * @memberof UnderpostTest
      */
     async setUpInfo() {
       return await setUpInfo(logger);
     },
+
     /**
      * @method run
-     * @description Runs the test of the application.
+     * @description Runs the selected tiers on this host.
+     *
+     * Resolved against the globally installed engine when the current directory
+     * is not one, so `underpost test` from anywhere still runs the shipped suites
+     * rather than failing on a missing config.
+     * @param {object} [params]
+     * @param {string} [params.suite] - Suite or tier selector.
+     * @param {string} [params.grep] - Substring filter on test names.
+     * @param {boolean} [params.watch] - Keep the runner open and re-run on change.
+     * @param {boolean} [params.coverage] - Emit the coverage reporters.
+     * @param {boolean} [params.allure] - Also write Allure results for the dashboard.
+     * @returns {void}
+     * @throws {Error} When no engine tree with a runner configuration can be found.
      * @memberof UnderpostTest
      */
-    run() {
+    run({ suite = '', grep = '', watch = false, coverage = true, allure = false } = {}) {
       actionInitLog();
-      const underpostTestPath = `${getNpmRootPath()}/underpost`;
-      if (fs.existsSync(underpostTestPath)) {
-        shellExec(`cd ${underpostTestPath} && npm run test`);
-      } else {
-        logger.warn(`Global underpost not found at ${underpostTestPath}, running local npm test instead`);
-        shellExec('npm test');
+      const root = [process.cwd(), getUnderpostRootPath()].find(
+        (candidate) => candidate && fs.existsSync(`${candidate}/vitest.config.js`),
+      );
+      if (!root) throw new Error('[test] no vitest.config.js in the current directory or the global underpost install');
+
+      const { projects, runVitest, delegated } = resolveTestSelection(suite);
+      const allureResultsDirectory =
+        allure &&
+        nodePath.resolve(
+          root,
+          process.env[UNDERPOST_TESTING.allureResultsEnvKey] || UNDERPOST_TESTING.allureResultsDirectory,
+        );
+
+      if (runVitest) {
+        const env = [
+          'NODE_ENV=test',
+          ...(allureResultsDirectory ? [`${UNDERPOST_TESTING.allureResultsEnvKey}=${allureResultsDirectory}`] : []),
+        ];
+        shellExec(
+          `cd ${root} && ${env.join(' ')} npx vitest ${vitestArgsFactory({ projects, grep, watch, coverage }).join(' ')}`,
+        );
+      }
+
+      for (const { name, directory, delegate } of delegated) {
+        const tierRoot = `${root}/${directory}`;
+        // A product build strips the tiers it does not own, so an absent
+        // directory is a tier this tree does not ship, not a failure.
+        if (!fs.existsSync(tierRoot)) {
+          logger.warn(`Skipping tier not present in this tree`, { tier: name, directory });
+          continue;
+        }
+        if (allureResultsDirectory) fs.mkdirSync(allureResultsDirectory, { recursive: true });
+        const resultsPath = allureResultsDirectory ? `${allureResultsDirectory}/TEST-${name}.xml` : '';
+        shellExec(`cd ${tierRoot} && ${delegate({ resultsPath, grep })}`);
       }
     },
+
     /**
-     * @method callback
-     * @description Manages the test of the application.
-     * @param {string} deployList - The list of deployments to test.
-     * @param {object} options - The options for the test.
-     * @param {boolean} options.itc - If true, tests the inside container.
-     * @param {boolean} options.sh - If true, tests the shell.
-     * @param {boolean} options.logs - If true, tests the logs.
-     * @param {string} options.podName - The name of the pod to test.
-     * @param {string} options.podStatus - The status of the pod to test.
-     * @param {string} options.kindType - The type of the kind to test.
-     * @param {number} options.deltaMs - The delta time in milliseconds.
-     * @param {number} options.maxAttempts - The maximum number of attempts.
+     * @method dashboard
+     * @description Applies the Allure dashboard: the results claim every run
+     * writes to, the report server, and the ways in.
+     * @param {object} params
+     * @param {string} [params.namespace='default'] - Target namespace.
+     * @param {string} [params.host] - Hostname to route the dashboard sub-path on.
+     * @param {boolean} [params.dryRun] - Print the manifests instead of applying them.
+     * @returns {string} The rendered manifests.
      * @memberof UnderpostTest
      */
-    async callback(
-      deployList = '',
-      options = {
-        itc: false,
-        sh: false,
-        logs: false,
-        podName: '',
-        podStatus: '',
-        kindType: '',
-        deltaMs: 1000,
-        maxAttempts: 60 * 5,
-      },
-    ) {
-      if (
-        options.podName &&
-        typeof options.podName === 'string' &&
-        options.podStatus &&
-        typeof options.podStatus === 'string'
-      )
-        return await Underpost.test.statusMonitor(options.podName, options.podStatus, options.kindType);
+    dashboard({ namespace = 'default', host = '', dryRun = false } = {}) {
+      const manifests = allureManifestsFactory({ namespace, host });
+      if (dryRun) {
+        console.log(manifests);
+        return manifests;
+      }
+      shellExec(`sudo kubectl apply -f - <<'EOF'\n${manifests}\nEOF`);
+      const { allure } = UNDERPOST_TESTING;
+      logger.info('Allure dashboard applied', {
+        namespace,
+        nodePort: allure.nodePort,
+        url: host ? `https://${host}${allure.subPath}` : '',
+      });
+      return manifests;
+    },
 
-      if (options.sh === true || options.logs === true) {
-        const [pod] = Underpost.kubectl.get(deployList);
-        if (pod) {
-          if (options.sh) return pbcopy(`sudo kubectl exec -it ${pod.NAME} -- sh`);
-          if (options.logs) return shellExec(`sudo kubectl logs -f ${pod.NAME}`);
-        }
-        return logger.warn(`Couldn't find pods in deployment`, deployList);
+    /**
+     * @method job
+     * @description Runs one suite on the cluster as a Job.
+     *
+     * The Job writes into the same claim the dashboard reads, so its results are
+     * published by finishing — there is no upload step to fail separately from
+     * the tests it would have reported.
+     * @param {object} params
+     * @param {string} params.image - Image carrying the engine and its dependencies.
+     * @param {string} [params.suite] - Suite or tier selector.
+     * @param {string} [params.namespace='default'] - Target namespace.
+     * @param {string} [params.nodeName] - Pins the pod to one node.
+     * @param {boolean} [params.dryRun] - Print the manifest instead of applying it.
+     * @returns {Promise<boolean>} Whether the Job's pod reached completion.
+     * @throws {Error} When no image is given.
+     * @memberof UnderpostTest
+     */
+    async job({ image = '', suite = '', namespace = 'default', nodeName = '', dryRun = false } = {}) {
+      if (!image) throw new Error('[test] --job needs --image: the Job has no engine tree of its own');
+      const name = `${UNDERPOST_TESTING.job.namePrefix}-${(suite || 'all').replace(/[^a-z0-9]+/g, '-')}-${Date.now()}`;
+      const manifest = testJobManifestFactory({ name, namespace, image, suite, nodeName });
+      if (dryRun) {
+        console.log(manifest);
+        return true;
       }
-      if (deployList) {
-        for (const _deployId of deployList.split(',')) {
-          const deployId = _deployId.trim();
-          if (!deployId) continue;
-          if (options.itc === true)
-            switch (deployId) {
-              case 'dd-lampp':
-                {
-                  const { MARIADB_HOST, MARIADB_USER, MARIADB_PASSWORD, DD_LAMPP_TEST_DB_0 } = process.env;
+      shellExec(`sudo kubectl apply -f - <<'EOF'\n${manifest}\nEOF`);
+      return await Underpost.test.statusMonitor(name, 'Completed', 'pods');
+    },
 
-                  await MariaDB.query({
-                    host: MARIADB_HOST,
-                    user: MARIADB_USER,
-                    password: MARIADB_PASSWORD,
-                    query: `SHOW TABLES FROM ${DD_LAMPP_TEST_DB_0}`,
-                  });
-                }
-                break;
+    /**
+     * @method callback
+     * @description `underpost test` entrypoint.
+     * @param {string} [suite] - Suite or tier selector.
+     * @param {object} [options]
+     * @param {boolean} [options.itc] - Run here rather than dispatching into pods.
+     * @param {string} [options.deployList] - Comma separated deploy ids to run inside.
+     * @param {boolean} [options.dashboard] - Apply the Allure dashboard and exit.
+     * @param {boolean} [options.job] - Run the suite as a cluster Job.
+     * @param {boolean} [options.allure] - Write Allure results alongside the run.
+     * @param {string} [options.grep] - Substring filter on test names.
+     * @param {boolean} [options.watch] - Keep the runner open and re-run on change.
+     * @param {boolean} [options.coverage] - Emit the coverage reporters.
+     * @param {string} [options.namespace] - Namespace for the cluster-side actions.
+     * @param {string} [options.image] - Image for `--job`.
+     * @param {string} [options.nodeName] - Node pin for `--job`.
+     * @param {string} [options.host] - Hostname for the dashboard route.
+     * @param {boolean} [options.dryRun] - Render manifests without applying them.
+     * @param {string} [options.podName] - Wait for this object instead of running tests.
+     * @param {string} [options.podStatus] - Status `--pod-name` waits for.
+     * @param {string} [options.kindType] - Kind `--pod-name` queries.
+     * @returns {Promise<void>}
+     * @memberof UnderpostTest
+     */
+    async callback(suite = '', options = {}) {
+      const { itc, deployList, dashboard, job, podName, podStatus, kindType, namespace = 'default' } = options;
 
-              default:
-                {
-                  shellExec('npm run test');
-                }
+      if (podName) return void (await Underpost.test.statusMonitor(podName, podStatus || 'Running', kindType));
+      if (dashboard) return void Underpost.test.dashboard(options);
+      if (job) return void (await Underpost.test.job({ ...options, suite }));
 
-                break;
-            }
-          else {
-            const pods = Underpost.kubectl.get(deployId);
-            if (pods.length > 0)
-              for (const deployData of pods) {
-                const { NAME } = deployData;
-                shellExec(
-                  `sudo kubectl exec -i ${NAME} -- sh -c "cd /home/dd/engine && underpost test ${deployId} --inside-container"`,
-                );
-              }
-            else logger.warn(`Couldn't find pods in deployment`, { deployId });
+      if (deployList && !itc) {
+        for (const deployId of deployList
+          .split(',')
+          .map((value) => value.trim())
+          .filter(Boolean)) {
+          const pods = Underpost.kubectl.get(deployId, 'pods', namespace);
+          if (pods.length === 0) {
+            logger.warn(`Couldn't find pods in deployment`, { deployId });
+            continue;
           }
+          for (const { NAME } of pods)
+            Underpost.kubectl.exec({
+              podName: NAME,
+              namespace,
+              command: `cd ${UNDERPOST_TESTING.job.workingDirectory} && underpost test ${suite} --itc`,
+            });
         }
-      } else return Underpost.test.run();
+        return;
+      }
+
+      return void Underpost.test.run({ ...options, suite });
     },
+
     /**
      * @method statusMonitor
-     * @description Monitors the status of a pod.
-     * @param {string} podName - The name of the pod to monitor.
-     * @param {string} status - The status of the pod to monitor.
-     * @param {string} kindType - The type of the kind to monitor.
-     * @param {number} deltaMs - The delta time in milliseconds.
-     * @param {number} maxAttempts - The maximum number of attempts.
+     * @description Waits for a cluster object to reach a status.
+     *
+     * `Completed` is accepted wherever `Running` was asked for: a Job's pod and a
+     * one-shot container both satisfy "it came up" by having finished, and a
+     * caller polling for readiness would otherwise time out on a success.
+     * @param {string} podName - Name, or name substring, of the object to watch.
+     * @param {string} [status='Running'] - Status to wait for.
+     * @param {string} [kindType='pods'] - Kind to query.
+     * @param {number} [deltaMs=1000] - Delay between attempts.
+     * @param {number} [maxAttempts=300] - Attempts before giving up.
+     * @returns {Promise<boolean>} Whether the status was reached.
      * @memberof UnderpostTest
      */
-    statusMonitor(podName, status = 'Running', kindType = '', deltaMs = 1000, maxAttempts = 60 * 5) {
-      if (!(kindType && typeof kindType === 'string')) kindType = 'pods';
-      return new Promise(async (resolve) => {
-        let index = 0;
-        logger.info(`Loading instance`, { podName, status, kindType, deltaMs, maxAttempts });
-        const _monitor = async () => {
-          await timer(deltaMs);
-          const pods = Underpost.kubectl.get(podName, kindType);
-          let result = pods.find((p) => p.STATUS === status || (status === 'Running' && p.STATUS === 'Completed'));
-          logger.info(
-            `Testing pod ${podName}... ${result ? 1 : 0}/1 - elapsed time ${deltaMs * (index + 1)}s - attempt ${index + 1
-            }/${maxAttempts}`,
-            pods[0] ? pods[0].STATUS : 'Not found kind object',
-          );
-          if (result) return resolve(true);
-          index++;
-          if (index === maxAttempts) {
-            logger.error(`Failed to test pod ${podName} within ${maxAttempts} attempts`);
-            return resolve(false);
-          }
-          return _monitor();
-        };
-        await _monitor();
-      });
+    async statusMonitor(podName, status = 'Running', kindType = 'pods', deltaMs = 1000, maxAttempts = 60 * 5) {
+      if (!kindType) kindType = 'pods';
+      logger.info(`Loading instance`, { podName, status, kindType, deltaMs, maxAttempts });
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        await timer(deltaMs);
+        const pods = Underpost.kubectl.get(podName, kindType);
+        const reached = pods.find(
+          (pod) => pod.STATUS === status || (status === 'Running' && pod.STATUS === 'Completed'),
+        );
+        logger.info(
+          `Testing pod ${podName}... ${reached ? 1 : 0}/1 - elapsed time ${deltaMs * attempt}ms - attempt ${attempt}/${maxAttempts}`,
+          pods[0] ? pods[0].STATUS : 'Not found kind object',
+        );
+        if (reached) return true;
+      }
+      logger.error(`Failed to test pod ${podName} within ${maxAttempts} attempts`);
+      return false;
     },
   };
 }

package/src/cli/vultr.js

@@ -10,7 +10,7 @@
  * This module is that meter. It reads the instance's consumption from the Vultr
  * API, compares it against the plan's quota, and — once a configured fraction of
  * it is gone — reaches the VPS over SSH and drops its egress with
- * {@link module:src/server/dns.js}'s `blockAllEgress`.
+ * {@link module:src/server/network/dns.js}'s `blockAllEgress`.
  *
  * That last step is deliberately blunt: it takes every hostname behind the hub
  * offline. It is the cheaper failure. An overage accrues silently and without a
@@ -19,7 +19,7 @@
  * inbound SSH session still completes its handshake and the host stays
  * reachable to undo it.
  *
- * The enforcement is latched in the root env rather than re-applied every run,
+ * The enforcement is latched in the host store rather than re-applied every run,
  * so a cron firing every ten minutes does not re-open an SSH session to a host
  * that is already blocked.
  *
@@ -28,9 +28,12 @@
  */
 
 import axios from 'axios';
-import { environmentValueFactory } from '../server/environment.js';
-import { FORWARD_PROXY, fetchViaForwardProxy } from '../server/forward-proxy.js';
-import { loggerFactory } from '../server/logger.js';
+import { environmentValueFactory } from '../server/runtime/environment.js';
+import { FORWARD_PROXY, fetchViaForwardProxy } from '../server/network/forward-proxy.js';
+import fs from 'fs-extra';
+import nodePath from 'node:path';
+import { loggerFactory } from '../server/ops/logger.js';
+import { UNDERPOST_MONITORING } from '../server/ops/monitoring.js';
 import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);
@@ -55,9 +58,8 @@ const UNDERPOST_VULTR = {
   requestTimeoutMs: 20000,
   defaultSshUser: 'root',
   defaultSshPort: 22,
-  defaultSshKeyPath: './engine-private/deploy/id_rsa',
   remoteEnginePath: '/home/dd/engine',
-  // Latched in the root env, which the CronJob mounts from the host, so the
+  // latched in the host store, which the CronJob mounts from the host, so the
   // decision survives the container that made it.
   latchKey: 'VULTR_EGRESS_BLOCKED_AT',
   env: {
@@ -80,13 +82,13 @@ const UNDERPOST_VULTR = {
  * @method envFactory
  * @description First non-empty value among a list of keys.
  *
- * Resolution is {@link module:src/server/environment.js.environmentValueFactory}'s — the process
- * environment, then the deploy env `underpost env <deploy-id> <environment>`
- * selects into `./.env`, then the underpost root env — rather than a second
+ * Resolution is {@link module:src/server/runtime/environment.js.environmentValueFactory}'s — the process
+ * environment, then the deploy env `underpost app load --env <environment>`
+ * selects into `./.env`, then the host store — rather than a second
  * implementation of it, because the three callers differ: a CronJob container has
  * its deploy env loaded into `process.env` by `loadCronDeployEnv`, an operator
- * preparing a manual run has `./.env`, and an operator who ran `underpost env
- * set` has the root env. Never logged — one of the keys this resolves is an API
+ * preparing a manual run has `./.env`, and an operator who ran `underpost host
+ * set` has the host store. Never logged — one of the keys this resolves is an API
  * key.
  * @param {string|Array<string>} keys - Environment variable name, or names in precedence order.
  * @returns {string} The resolved value, or an empty string.
@@ -294,7 +296,7 @@ const vultrRequest = async ({ apiKey, path, params = {}, proxy = null }) => {
     const code = error?.code || error?.cause?.code;
     const proxyHint =
       proxy?.apiKey && ['EHOSTUNREACH', 'ENETUNREACH', 'ECONNREFUSED', 'ETIMEDOUT'].includes(code)
-        ? '; verify wg0 on the spoke; if only pods fail, re-run --wireguard-setup --client and restart wg0; if the host also fails, re-run --forward-proxy-server on the hub'
+        ? '; verify wg0 on the node; if only pods fail, re-run --wireguard-setup and restart wg0; if the host also fails, re-run --forward-proxy-server on the hub'
         : '';
     throw new Error(
       `[vultr] GET /v2${path} failed${responseStatus ? ` (${responseStatus})` : ''}: ${detail}${proxyHint}`,
@@ -353,7 +355,7 @@ class UnderpostVultr {
      * {@link UnderpostCron} job does, so `underpost cron default vultr` dispatches
      * to it unchanged. The deploy list is not used to select an instance — the
      * edge hub is one machine for the whole cluster, exactly as its WireGuard
-     * peer registry is — but it is logged so a run is attributable.
+     * WireGuard topology is — but it is logged so a run is attributable.
      * @param {string} [deployList] - Comma-separated deploy ids, from the cron dispatcher.
      * @param {object} [options] - CLI flags.
      * @returns {Promise<object>} Result from {@link UnderpostVultr.checkBandwidth}.
@@ -363,6 +365,43 @@ class UnderpostVultr {
       return await UnderpostVultr.API.checkBandwidth({ ...options, deployList });
     },
 
+    /**
+     * @method publishBandwidthMetrics
+     * @description Publishes the measured quota so the cluster can read it
+     * without calling Vultr.
+     *
+     * The API is rate limited and needs a credential, neither of which belongs
+     * on an alert evaluation path, so the guard — which already holds the
+     * numbers — writes them where the host collector picks them up, and to the
+     * host configuration store for anything that reads configuration rather than metrics.
+     * The file is renamed into place because the collector may read it mid-write.
+     * @param {{consumedBytes: number, maxBytes: number}} state - Measured quota state.
+     * @returns {boolean} True when the metrics file was written.
+     * @memberof UnderpostVultr
+     */
+    publishBandwidthMetrics({ consumedBytes = 0, maxBytes = 0 } = {}) {
+      Underpost.host.store.set('VULTR_BANDWIDTH_USAGE_BYTES', `${consumedBytes}`);
+      Underpost.host.store.set('VULTR_BANDWIDTH_LIMIT_BYTES', `${maxBytes}`);
+
+      const target = `${UNDERPOST_MONITORING.nodeExporter.textfileDirectory}/vultr_bandwidth.prom`;
+      const content =
+        '# HELP vultr_bandwidth_used_bytes Monthly bandwidth consumed by the edge hub.\n' +
+        '# TYPE vultr_bandwidth_used_bytes gauge\n' +
+        `vultr_bandwidth_used_bytes ${consumedBytes}\n` +
+        '# HELP vultr_bandwidth_limit_bytes Monthly bandwidth quota of the edge hub plan.\n' +
+        '# TYPE vultr_bandwidth_limit_bytes gauge\n' +
+        `vultr_bandwidth_limit_bytes ${maxBytes}\n`;
+      try {
+        fs.mkdirpSync(nodePath.dirname(target));
+        fs.writeFileSync(`${target}.tmp`, content, 'utf8');
+        fs.renameSync(`${target}.tmp`, target);
+        return true;
+      } catch (error) {
+        logger.warn('Bandwidth metrics not published to the host collector', { target, error: `${error.message}` });
+        return false;
+      }
+    },
+
     /**
      * @method resolveConfig
      * @description Every input the guard needs, resolved once.
@@ -382,10 +421,9 @@ class UnderpostVultr {
         threshold: thresholdFactory(options.threshold || envFactory(UNDERPOST_VULTR.env.threshold)),
         host: `${options.host || ''}`.trim() || envFactory(UNDERPOST_VULTR.env.host),
         user: `${options.user || ''}`.trim() || envFactory(UNDERPOST_VULTR.env.user) || UNDERPOST_VULTR.defaultSshUser,
-        keyPath:
-          `${options.keyPath || ''}`.trim() ||
-          envFactory(UNDERPOST_VULTR.env.keyPath) ||
-          UNDERPOST_VULTR.defaultSshKeyPath,
+        keyPath: Underpost.ssh.keyPathFactory(
+          `${options.keyPath || ''}`.trim() || envFactory(UNDERPOST_VULTR.env.keyPath),
+        ),
         port: Number(options.port || envFactory(UNDERPOST_VULTR.env.port)) || UNDERPOST_VULTR.defaultSshPort,
         // `total` is the conservative reading and trips first; `outgoing` counts
         // egress alone, which is what a plan billing outbound-only meters.
@@ -441,7 +479,9 @@ class UnderpostVultr {
       const totals = bandwidthTotalsFactory({ bandwidth, month: config.month });
       const consumedBytes = config.metric === 'outgoing' ? totals.outgoingBytes : totals.totalBytes;
       const state = quotaStateFactory({ consumedBytes, planBandwidthGB, threshold: config.threshold });
-      const latchedAt = `${Underpost.env.get(UNDERPOST_VULTR.latchKey, undefined, { disableLog: true }) ?? ''}`.trim();
+      UnderpostVultr.API.publishBandwidthMetrics(state);
+      const latchedAt =
+        `${Underpost.host.store.get(UNDERPOST_VULTR.latchKey, undefined, { disableLog: true }) ?? ''}`.trim();
 
       const summary = {
         instanceId: config.instanceId,
@@ -472,7 +512,7 @@ class UnderpostVultr {
         // real trigger, so it is cleared as soon as usage is back under the
         // threshold — but the host stays blocked until someone says otherwise.
         if (latchedAt) {
-          if (!config.dryRun) Underpost.env.delete(UNDERPOST_VULTR.latchKey);
+          if (!config.dryRun) Underpost.host.store.delete(UNDERPOST_VULTR.latchKey);
           if (config.autoUnblock) await UnderpostVultr.API.setEdgeEgress({ config, blocked: false });
           else
             logger.warn('Edge egress is still blocked from a previous cycle; unblock it when you are ready', {
@@ -496,7 +536,7 @@ class UnderpostVultr {
       }
 
       const enforced = await UnderpostVultr.API.setEdgeEgress({ config, blocked: true });
-      if (enforced && !config.dryRun) Underpost.env.set(UNDERPOST_VULTR.latchKey, new Date().toISOString());
+      if (enforced && !config.dryRun) Underpost.host.store.set(UNDERPOST_VULTR.latchKey, new Date().toISOString());
       return { ...state, ...summary, enforced, latched: enforced };
     },