@celilo/cli 0.17.0 → 0.19.0

package/src/cli/commands/module-operations.test.ts

@@ -6,7 +6,7 @@ import { eq } from 'drizzle-orm';
 import { closeDb, getDb } from '../../db/client';
 import { runMigrations } from '../../db/migrate';
 import { moduleOperations } from '../../db/schema';
-import { OPERATION_TTL_MS } from '../../services/module-operations';
+import { ABANDONED_RELEASE_MESSAGE, OPERATION_TTL_MS } from '../../services/module-operations';
 import { handleModuleOperations } from './module-operations';
 
 describe('celilo module operations', () => {
@@ -85,6 +85,50 @@ describe('celilo module operations', () => {
     expect(statusOf('expired')).toBe('in_progress');
   });
 
+  // The recurrence gate for #581: the sweep runs on every hourly tick, so an
+  // abandoned row must be reclaimed once and then stop being work. Before
+  // this, rows only ever accumulated — 85 of them, the oldest 62 days old.
+  it('reclaims an abandoned row and does not re-collect it on the next sweep', () => {
+    insert('expired', process.pid, OPERATION_TTL_MS + 60_000);
+
+    const first = handleModuleOperations(['clear'], {});
+    if (!first.success) throw new Error(`expected success, got: ${first.error}`);
+    expect(first.message).toContain('Released 1');
+    expect(statusOf('expired')).toBe('failed');
+
+    const second = handleModuleOperations(['clear'], {});
+    if (!second.success) throw new Error(`expected success, got: ${second.error}`);
+    expect(second.message).toContain('no operations in progress');
+
+    // Reclaimed, not deleted: the released row is the evidence the
+    // abandoned-operations audit reads.
+    const row = getDb()
+      .select()
+      .from(moduleOperations)
+      .where(eq(moduleOperations.id, 'expired'))
+      .get();
+    expect(row?.errorMessage).toBe(ABANDONED_RELEASE_MESSAGE);
+  });
+
+  it('hides abandoned rows from list by default and shows them with --abandoned', () => {
+    insert('expired', process.pid, OPERATION_TTL_MS + 60_000);
+
+    const lines: string[] = [];
+    const original = console.log;
+    console.log = (msg?: unknown) => lines.push(String(msg));
+    try {
+      handleModuleOperations(['list'], {});
+      expect(lines.join('\n')).not.toContain('pid');
+      expect(lines.join('\n')).toContain('1 abandoned row(s) hidden');
+
+      lines.length = 0;
+      handleModuleOperations(['list'], { abandoned: true });
+      expect(lines.join('\n')).toContain('abandoned (expired)');
+    } finally {
+      console.log = original;
+    }
+  });
+
   it('rejects an unknown action rather than silently listing', () => {
     const result = handleModuleOperations(['nuke'], {});
     if (result.success) throw new Error('expected an unknown action to fail');

package/src/cli/commands/module-operations.ts

@@ -10,12 +10,22 @@
  *
  * `clear` marks rows failed rather than deleting them — the history of
  * what was abandoned, and when, is worth more than a tidy table.
+ *
+ * That is load-bearing now, not merely tidy: `clear` runs hourly off the
+ * bus, and `services/audit/abandoned-operations.ts` reads exactly these
+ * released rows to notice that one module's backup is being killed over
+ * and over. Turning this into a DELETE would tidy the table and silently
+ * destroy the only signal that a repeatedly-dying operation ever leaves.
  */
 
 import { and, eq } from 'drizzle-orm';
 import { getDb } from '../../db/client';
 import { type ModuleOperation, moduleOperations } from '../../db/schema';
-import { OPERATION_TTL_MS, isPidRunnable } from '../../services/module-operations';
+import {
+  ABANDONED_RELEASE_MESSAGE,
+  OPERATION_TTL_MS,
+  isPidRunnable,
+} from '../../services/module-operations';
 import type { CommandResult } from '../types';
 
 /** Why a row is not holding the lock, or null when it still is. */
@@ -41,36 +51,49 @@ function inProgressRows(): ModuleOperation[] {
     .all();
 }
 
-function handleList(): CommandResult {
+/**
+ * Abandoned rows are summarised, not listed, unless `--abandoned` asks for
+ * them. The question this command answers is "what holds the lock right
+ * now", and on a fleet where something is dying repeatedly the answer was
+ * buried under 85 corpses. The count still prints, so they never become
+ * invisible — the audit is what reads them as a symptom
+ * (`services/audit/abandoned-operations.ts`).
+ */
+function handleList(flags: Record<string, boolean | string>): CommandResult {
   const now = Date.now();
   const rows = inProgressRows();
+  const showAbandoned = flags.abandoned === true || flags.all === true;
 
   if (rows.length === 0) {
     console.log('\nNo module operations in progress.\n');
     return { success: true, message: 'no operations in progress' };
   }
 
+  const holding = rows.filter((row) => abandonedReason(row, now) === null);
+  const abandoned = rows.length - holding.length;
+  const shown = showAbandoned ? rows : holding;
+
   console.log('\nModule operations in progress:\n');
-  let holding = 0;
-  for (const row of rows) {
+  for (const row of shown) {
     const reason = abandonedReason(row, now);
-    if (!reason) holding++;
     const age = formatAge(now - row.startedAt.getTime());
     const status = reason ? `abandoned (${reason})` : 'HOLDING LOCK';
     console.log(
       `  ${row.operation.padEnd(9)} ${row.moduleId.padEnd(16)} pid ${String(row.pid).padEnd(8)} ${age.padStart(4)} ago   ${status}`,
     );
   }
+  if (shown.length === 0) console.log('  (nothing is holding the lock)');
 
-  const abandoned = rows.length - holding;
   console.log('');
-  if (abandoned > 0) {
-    console.log(`${abandoned} abandoned row(s) — "celilo module operations clear" sweeps them.\n`);
+  if (abandoned > 0 && !showAbandoned) {
+    console.log(
+      `${abandoned} abandoned row(s) hidden — "--abandoned" lists them, the hourly sweep clears them.\n`,
+    );
   }
 
   return {
     success: true,
-    message: `${rows.length} in progress (${holding} holding the lock, ${abandoned} abandoned)`,
+    message: `${rows.length} in progress (${holding.length} holding the lock, ${abandoned} abandoned)`,
   };
 }
 
@@ -108,7 +131,7 @@ function handleClear(flags: Record<string, boolean | string>): CommandResult {
       .set({
         status: 'failed',
         completedAt: new Date(),
-        errorMessage: 'abandoned — released by "celilo module operations clear"',
+        errorMessage: ABANDONED_RELEASE_MESSAGE,
       })
       .where(and(eq(moduleOperations.id, row.id), eq(moduleOperations.status, 'in_progress')))
       .run();
@@ -124,11 +147,11 @@ export function handleModuleOperations(
 ): CommandResult {
   const action = args[0];
 
-  if (!action || action === 'list') return handleList();
+  if (!action || action === 'list') return handleList(flags);
   if (action === 'clear') return handleClear(flags);
 
   return {
     success: false,
-    error: `Unknown action "${action}"\n\nUsage: celilo module operations [list|clear] [--all]`,
+    error: `Unknown action "${action}"\n\nUsage: celilo module operations [list|clear] [--abandoned] [--all]`,
   };
 }

package/src/cli/commands/module-show.ts

@@ -171,6 +171,7 @@ export async function handleModuleShowZone(args: string[]): Promise<CommandResul
       secure: 'Secure (Authentication/Database)',
       'secure-mgmt': "Secure-Mgmt (celilo's own control plane)",
       external: 'External (VPS/Cloud)',
+      'control-plane-vpn': 'Control-plane VPN (administrative remote access)',
     };
 
     // Cast at the lookup, not the declaration: `zone` comes from config and may be

package/src/cli/commands/module-update.test.ts

@@ -11,7 +11,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../../db/client';
 import { modules } from '../../db/schema';
-import { classifyVersionChange, updateOne } from './module-update';
+import { classifyVersionChange, handleModuleUpdate, updateOne } from './module-update';
 
 describe('classifyVersionChange', () => {
   test('identical versions are up-to-date', () => {
@@ -250,3 +250,74 @@ subscriptions:
     }
   });
 });
+
+/**
+ * Regression for the fabricated decline: driven headlessly with no responder,
+ * the registry sweep reported a breaking update as "operator declined" — a
+ * decision nobody was asked to make. An unanswerable question is not a "no".
+ */
+describe('registry sweep — an unanswered breaking update is not a decline', () => {
+  let tempDir: string;
+  let server: ReturnType<typeof Bun.serve>;
+  let registryUrl: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-sweep-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+    // Isolated bus with no responder attached — the headless case.
+    process.env.EVENT_BUS_DB = join(tempDir, 'events.db');
+
+    getDb()
+      .insert(modules)
+      .values({
+        id: 'iptables',
+        name: 'iptables',
+        sourcePath: join(tempDir, 'installed'),
+        version: '1.0.2+9',
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'iptables',
+          name: 'iptables',
+          version: '1.0.2',
+        },
+      })
+      .run();
+
+    // Minimal sparse-index server offering a major bump for `iptables`.
+    server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        const path = new URL(req.url).pathname;
+        if (path === '/index/ip/ta/iptables') {
+          return new Response(
+            `${JSON.stringify({ name: 'iptables', vers: '2.0.0+1', deps: [], cksum: 'x' })}\n`,
+          );
+        }
+        return new Response('not found', { status: 404 });
+      },
+    });
+    registryUrl = `http://localhost:${server.port}`;
+  });
+
+  afterEach(() => {
+    server.stop(true);
+    rmSync(tempDir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+    process.env.CELILO_ORIGINAL_CWD = undefined;
+    process.env.EVENT_BUS_DB = undefined;
+  });
+
+  test('reports it as unanswered, never as declined, and fails the sweep', async () => {
+    const result = await handleModuleUpdate([], { registry: registryUrl });
+
+    const report = result.success ? (result.message ?? '') : (result.error ?? '');
+    expect(report).not.toContain('operator declined');
+    expect(report).toContain('NOT declined');
+    expect(report).toContain('iptables');
+    // A breaking update that silently didn't land must not read as success.
+    expect(result.success).toBe(false);
+    // And the module is still on the old version — no accidental upgrade.
+    expect(getDb().select().from(modules).all()[0].version).toBe('1.0.2+9');
+  });
+});

package/src/cli/commands/module-update.ts

@@ -23,6 +23,7 @@ import type { ModuleManifest } from '../../manifest/schema';
 import { cleanupTempDir, extractPackage } from '../../module/packaging/extract';
 import { RegistryClient } from '../../registry/client';
 import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { InterviewUnansweredError } from '../../services/interview-errors';
 import { getFlag } from '../parser';
 import { log } from '../prompts';
 import type { CommandResult } from '../types';
@@ -496,7 +497,8 @@ async function runRegistrySweep(
   }
 
   let appliedBreaking = 0;
-  let skippedBreaking = 0;
+  let declinedBreaking = 0;
+  const unanswered: Array<{ moduleId: string; error: string }> = [];
 
   if (breaking.length > 0) {
     log.info('\nBreaking updates available — review required (semver-major bump):');
@@ -508,16 +510,29 @@ async function runRegistrySweep(
     log.message('Each breaking update will be applied only on explicit confirmation.\n');
 
     for (const plan of breaking) {
-      const proceed = await withInterviewSession(() =>
-        askConfirm({
-          scope: `module-upgrade:${plan.moduleId}`,
-          key: 'apply_breaking',
-          message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
-          defaultValue: false,
-        }),
-      );
+      let proceed: boolean;
+      try {
+        proceed = await withInterviewSession(() =>
+          askConfirm({
+            scope: `module-upgrade:${plan.moduleId}`,
+            key: 'apply_breaking',
+            message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
+            defaultValue: false,
+          }),
+        );
+      } catch (err) {
+        // Nobody could answer. That is NOT a decline — record it as unanswered
+        // so the summary says so and the sweep exits non-zero, and keep going
+        // so the updates already applied aren't thrown away with a hard abort.
+        if (!(err instanceof InterviewUnansweredError)) throw err;
+        unanswered.push({ moduleId: plan.moduleId, error: err.message });
+        console.log(
+          `  ? ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (major, UNANSWERED)`,
+        );
+        continue;
+      }
       if (!proceed) {
-        skippedBreaking++;
+        declinedBreaking++;
         continue;
       }
       const result = await fetchAndUpdate(client, plan.moduleId, plan.targetVersion, db, flags);
@@ -545,8 +560,17 @@ async function runRegistrySweep(
   } else {
     summary.push('No updates applied.');
   }
-  if (skippedBreaking > 0) {
-    summary.push(`Skipped ${skippedBreaking} breaking update(s) (operator declined).`);
+  if (declinedBreaking > 0) {
+    summary.push(`Skipped ${declinedBreaking} breaking update(s) (operator declined).`);
+  }
+  if (unanswered.length > 0) {
+    summary.push(
+      `Skipped ${unanswered.length} breaking update(s) — NOT declined: the confirmation could not be answered (${unanswered
+        .map((u) => u.moduleId)
+        .join(
+          ', ',
+        )}). Re-run with a responder attached, or pre-stage the answer under "module-upgrade:<module>.apply_breaking".`,
+    );
   }
   if (notInRegistry.length > 0) {
     summary.push(`Not in registry (${notInRegistry.length}): ${notInRegistry.join(', ')}`);
@@ -556,16 +580,15 @@ async function runRegistrySweep(
       `Registry errors (${errored.length}): ${errored.map((e) => `${e.moduleId} — ${e.error}`).join('; ')}`,
     );
   }
-  if (failed.length > 0) {
-    return {
-      success: false,
-      error: [
-        ...summary,
-        '',
-        'Failures:',
-        ...failed.map((f) => `  ${f.moduleId}: ${f.error}`),
-      ].join('\n'),
-    };
+  if (failed.length > 0 || unanswered.length > 0) {
+    const detail: string[] = [];
+    if (failed.length > 0) {
+      detail.push('', 'Failures:', ...failed.map((f) => `  ${f.moduleId}: ${f.error}`));
+    }
+    if (unanswered.length > 0) {
+      detail.push('', 'Unanswered:', ...unanswered.map((u) => `  ${u.moduleId}: ${u.error}`));
+    }
+    return { success: false, error: [...summary, ...detail].join('\n') };
   }
   return { success: true, message: summary.join('\n') };
 }

package/src/cli/commands/system-audit.ts

@@ -38,6 +38,7 @@ import { getOrCreateMasterKey } from '../../secrets/master-key';
 import { readAllTransportStatuses } from '../../services/alerting/read-records';
 import { runAudit } from '../../services/audit';
 import type { DriftFinding, SystemAuditReport } from '../../services/audit';
+import { loadAbandonedOperations } from '../../services/audit/abandoned-operations';
 import { loadBackupAuditInfo } from '../../services/audit/backup-source';
 import {
   type LatestCliVersionFetcher,
@@ -363,6 +364,7 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     moduleConfigs: { modules: installedConfigs },
     health: { results: healthResults },
     backups: { modules: installedBackupInfo },
+    abandonedOperations: { records: loadAbandonedOperations(db) },
     undeployedModules: {
       modules: installed.map((m) => ({ id: m.id, state: m.state })),
     },

package/src/cli/commands/system-migrate.test.ts

@@ -1,3 +1,4 @@
+import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -37,4 +38,59 @@ describe('handleSystemMigrate', () => {
     const second = await handleSystemMigrate();
     expect(second.success).toBe(true);
   });
+
+  // celilo#604: the runbook asserts "applied 19 -> 20, backups.pid present".
+  // Before this, the only answer was a table COUNT, which cannot see a column.
+  describe('--status', () => {
+    it('names the applied count and the latest applied migration', async () => {
+      await handleSystemMigrate();
+      closeDb();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.message).toMatch(/Applied migrations: \d+/);
+        expect(result.message).toContain('0019_backup_pid');
+        expect(result.message).toContain('Pending:            none');
+        expect(result.message).toContain('columns');
+      }
+    });
+
+    it('reports a pending migration WITHOUT applying it', async () => {
+      await handleSystemMigrate();
+      closeDb();
+      // Rewind one migration, the way an upgrade that never ran would look.
+      const raw = new Database(process.env.CELILO_DB_PATH as string);
+      raw.run(
+        'DELETE FROM `__drizzle_migrations` WHERE created_at = (SELECT MAX(created_at) FROM `__drizzle_migrations`)',
+      );
+      raw.run('ALTER TABLE backups DROP COLUMN pid');
+      const countBefore = raw
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      raw.close();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('0019_backup_pid');
+        expect(result.error).toContain('backups.pid');
+      }
+
+      // A status that repaired what it reports would always read clean — the
+      // exact placebo this command exists to replace.
+      const after = new Database(process.env.CELILO_DB_PATH as string);
+      const countAfter = after
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      const cols = after
+        .query<{ name: string }, []>("SELECT name FROM pragma_table_info('backups')")
+        .all();
+      after.close();
+      expect(countAfter).toBe(countBefore as number);
+      expect(cols.map((c) => c.name)).not.toContain('pid');
+    });
+  });
 });

package/src/cli/commands/system-migrate.ts

@@ -8,11 +8,50 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import { getDb } from '../../db/client';
+import { defineEvents, openBus } from '@celilo/event-bus';
+import { getEventBusPath } from '../../config/paths';
+import { createDbClient, findMigrationsFolder, getDb } from '../../db/client';
 import { runMigrationsOn } from '../../db/migrate';
+import { getMigrationStatus } from '../../db/migration-status';
 import { findSchemaDrift } from '../../db/schema-introspection';
+import { ensureBackupSweepSubscriber } from '../../services/backup-sweep';
+import { ensureOperationsSweepSubscriber } from '../../services/module-operations';
 import type { CommandResult } from '../types';
 
+/**
+ * Arm celilo's own housekeeping subscribers.
+ *
+ * Here because this command is what the .deb postinst runs on every apt
+ * upgrade — the one moment guaranteed to happen after new CLI code lands.
+ * A subscriber registered only from module install/update would not appear
+ * until some module happened to be touched next, which can be weeks and
+ * looks exactly like a feature that shipped and silently does nothing.
+ *
+ * Best-effort: a bus that can't be opened must not fail a schema migration.
+ */
+function ensureCoreSubscribers(): void {
+  try {
+    const bus = openBus({ dbPath: getEventBusPath(), events: defineEvents({}) });
+    try {
+      ensureOperationsSweepSubscriber(bus);
+      // The backup sweep is armed here for the same reason, plus a sharper one:
+      // its row already exists on every deployed fleet, carrying the 60s bus
+      // default that made scheduled backups impossible. Correcting the default
+      // in code does nothing until something re-registers, and module
+      // install/update can be weeks away. This is the upgrade path.
+      //
+      // This also re-arms a sweep an operator paused by hand. Deliberate: the
+      // pause exists only because staging leaked, and the reaper that stops it
+      // leaking ships in this same binary.
+      ensureBackupSweepSubscriber(bus);
+    } finally {
+      bus.close();
+    }
+  } catch {
+    // Nothing to do — the next module install/update arms it.
+  }
+}
+
 function countApplied(sqlite: Database): number {
   try {
     const row = sqlite
@@ -24,7 +63,50 @@ function countApplied(sqlite: Database): number {
   }
 }
 
-export async function handleSystemMigrate(): Promise<CommandResult> {
+/**
+ * `celilo system migrate --status` — read-only interrogation (celilo#604).
+ *
+ * A rollout runbook that says "assert applied 19 → 20 and `backups.pid`
+ * present" needs a product surface to assert against; the table count that used
+ * to be the only answer cannot see a column migration at all.
+ */
+export function migrationStatusResult(sqlite: Database): CommandResult {
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
+  const missing = [...status.missingTables, ...status.missingColumns];
+  const lines = [
+    `Applied migrations: ${status.appliedCount}`,
+    `Latest applied:     ${status.latestApplied ?? '(none)'}`,
+    status.pending.length > 0
+      ? `Pending:            ${status.pending.join(', ')}`
+      : 'Pending:            none',
+    `Schema present:     ${status.tableCount} tables, ${status.columnCount} columns`,
+    ...(missing.length > 0 ? [`Missing:            ${missing.join(', ')}`] : []),
+  ];
+  if (status.pending.length > 0 || missing.length > 0) {
+    return {
+      success: false,
+      error: `${lines.join('\n')}\n\nRun \`celilo system migrate\` to apply pending migrations on this box.`,
+    };
+  }
+  return { success: true, message: lines.join('\n'), data: status };
+}
+
+export async function handleSystemMigrate(
+  _args: string[] = [],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  // --status must NOT migrate. getDb() auto-migrates on open, so a status that
+  // went through it would repair the very state it claims to be reporting and
+  // could never say "pending" — the placebo shape this command exists to end.
+  if (flags.status) {
+    const ro = createDbClient({ readonly: true });
+    try {
+      return migrationStatusResult(ro.$client);
+    } finally {
+      ro.$client.close();
+    }
+  }
+
   // getDb() auto-migrates on open; do it inside try so an existing DB that
   // predates the drizzle-authoritative change fails with an actionable message
   // instead of a raw migrator error.
@@ -57,9 +139,15 @@ export async function handleSystemMigrate(): Promise<CommandResult> {
     };
   }
 
+  ensureCoreSubscribers();
+
+  // Name the latest migration, not just a table count: "35 tables" reads the
+  // same whether a column migration applied or silently did nothing (celilo#604).
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
   const lines = [
     applied > 0 ? `Applied ${applied} migration(s).` : 'Schema already up to date.',
-    `Schema current: ${drift.tableCount} tables.`,
+    `Applied migrations: ${status.appliedCount} (latest: ${status.latestApplied ?? 'none'})`,
+    `Schema current: ${drift.tableCount} tables, ${drift.columnCount} columns.`,
   ];
-  return { success: true, message: lines.join('\n') };
+  return { success: true, message: lines.join('\n'), data: status };
 }

package/src/cli/commands/system-update.ts

@@ -26,6 +26,7 @@ import { backups, moduleConfigs as moduleConfigsTbl, modules } from '../../db/sc
 import type { ModuleManifest } from '../../manifest/schema';
 import { RegistryClient } from '../../registry/client';
 import { runAudit } from '../../services/audit';
+import { loadAbandonedOperations } from '../../services/audit/abandoned-operations';
 import { fetchLatestCliVersion } from '../../services/audit/cli-version';
 import { makeJournalReader, readAppliedMigrations } from '../../services/audit/schema';
 import { createModuleBackup, createSystemStateBackup } from '../../services/backup-create';
@@ -567,6 +568,7 @@ export async function handleSystemUpdate(
         lastSuccessfulBackupAt: latestBackupByModule.get(m.id) ?? null,
       })),
     },
+    abandonedOperations: { records: loadAbandonedOperations(db) },
     undeployedModules: {
       modules: installed.map((m) => ({ id: m.id, state: m.state })),
     },
@@ -778,6 +780,9 @@ export function rebuildAuditDepsForRerun(
         configs: configsByModule.get(m.id) ?? {},
       })),
     },
+    // Unchanged across an orchestrator run — an upgrade does not reclaim
+    // abandoned operations, so re-reading them would be the same rows.
+    abandonedOperations: original.abandonedOperations,
     backups: {
       ...original.backups,
       modules: upgradable.map((m) => ({

package/src/cli/completion.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import { getDb } from '../db/client';
 import { capabilities, modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { SCHEDULABLE_BUILTIN_CHECKS } from '../services/alerting/builtin-source';
 import { listPrincipals } from '../services/api-access';
 import { listBackups } from '../services/backup-metadata';
 import { listBackupStorages } from '../services/backup-storage';
@@ -124,6 +125,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'respond',
       'install-daemon',
       'uninstall-daemon',
+      'restart-daemon',
       'show-daemon',
     ];
     return filterSuggestions(subcommands, args[1] || '');
@@ -479,6 +481,23 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(['list', 'add', 'run', 'enable', 'disable'], args[1] || '');
   }
 
+  // Monitor targets - a module ID or one of celilo's own schedulable checks.
+  // Sourced from SCHEDULABLE_BUILTIN_CHECKS rather than a hand-copied list, so
+  // a new built-in check is completable the moment it is schedulable.
+  if (
+    command === 'monitor' &&
+    (args[1] === 'add' || args[1] === 'run' || args[1] === 'enable' || args[1] === 'disable') &&
+    currentIndex === 2
+  ) {
+    const db = getDb();
+    const moduleIds = db
+      .select({ id: modules.id })
+      .from(modules)
+      .all()
+      .map((m) => m.id);
+    return filterSuggestions([...SCHEDULABLE_BUILTIN_CHECKS, ...moduleIds], args[2] || '');
+  }
+
   // Alerts subcommands
   if (command === 'alerts' && currentIndex === 1) {
     return filterSuggestions(['list', 'ack', 'silence', 'resolve', 'sweep', 'poll'], args[1] || '');

package/src/cli/fuel-gauge.ts

@@ -334,7 +334,6 @@ export class FuelGauge {
    * Strip ANSI codes from text
    */
   private stripAnsi(text: string): string {
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: ESC character needed for ANSI code matching
     return text.replace(/\u001b\[[0-9;]*m/g, '');
   }
 

package/src/cli/generate-zsh-completion.ts

@@ -361,7 +361,7 @@ _celilo_system_config_keys() {
     'network.internal.gateway:Internal gateway IP'
     'network.secure-mgmt.subnet:Control-plane subnet (celilo-mgr own network)'
     'network.secure-mgmt.gateway:Control-plane gateway IP'
-    'network.vpn.subnet:VPN client subnet (WireGuard remote access)'
+    'network.control-plane-vpn.subnet:Administrative VPN client subnet (WireGuard remote access)'
     'firewall.trusted_subnets:Extra subnets that reach every managed zone (comma-separated CIDRs)'
     'dns.primary:Primary DNS server'
     'dns.fallback:Fallback DNS servers'