@celilo/cli 0.17.0 → 0.19.0

package/src/services/fleet-checks.test.ts

@@ -39,9 +39,9 @@ function seedHeartbeat(
   );
 }
 
-/** Write a supervisor unit file so readInstalledUnit('user') sees it. */
-function installFakeUnit(home: string): void {
-  const path = getDaemonUnitPath('linux', home, 'user');
+/** Write a supervisor unit file so readInstalledUnit(scope) sees it. */
+function installFakeUnit(home: string, scope: 'user' | 'system' = 'user', systemRoot = '/'): void {
+  const path = getDaemonUnitPath('linux', home, scope, systemRoot);
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, '[Unit]\nDescription=fake\n');
 }
@@ -114,6 +114,51 @@ describe('checkDispatcher', () => {
     expect(f.detail.join(' ')).toContain('not under a supervisor');
   });
 
+  // #610 — celilo-mgr had a dead system unit and a live user-scope unit of the
+  // SAME name. The old file-exists test called that "supervised".
+  it('fails when the running dispatcher is not the pid any installed unit supervises', () => {
+    seedHeartbeat(bus, { startedAt: now - MINUTE, lastHeartbeat: now - 1000, pid: 588704 });
+    installFakeUnit(home);
+    const f = checkDispatcher(bus, {
+      now: now,
+      home,
+      platform: 'linux',
+      unitMainPid: () => 3639051, // systemd supervises a different process
+    });
+    expect(f.status).toBe('fail');
+    expect(f.detail.join(' ')).toContain('not the process any installed unit supervises');
+  });
+
+  it('fails when both a user-scope and a system-scope unit are installed', () => {
+    seedHeartbeat(bus, { startedAt: now - MINUTE, lastHeartbeat: now - 1000, pid: 4242 });
+    installFakeUnit(home);
+    installFakeUnit(home, 'system', dir);
+    const f = checkDispatcher(bus, {
+      now: now,
+      home,
+      systemRoot: dir,
+      platform: 'linux',
+      unitMainPid: () => 4242,
+    });
+    expect(f.status).toBe('fail');
+    expect(f.detail.join(' ')).toContain('same unit name, different services');
+  });
+
+  // Null is ignorance, not evidence: a systemd probe that fails must not
+  // manufacture an orphan report.
+  it('makes no supervision claim when the unit pid cannot be determined', () => {
+    seedHeartbeat(bus, { startedAt: now - MINUTE, lastHeartbeat: now - 1000, pid: 4242 });
+    installFakeUnit(home);
+    const f = checkDispatcher(bus, {
+      now: now,
+      home,
+      platform: 'linux',
+      installedCodeMtimeMs: now - 2 * MINUTE,
+      unitMainPid: () => null,
+    });
+    expect(f.status).toBe('ok');
+  });
+
   it('warns when the dispatcher started before the installed code (stale)', () => {
     seedHeartbeat(bus, { startedAt: now - 10 * MINUTE, lastHeartbeat: now - 1000 });
     installFakeUnit(home);
@@ -425,7 +470,7 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
     it('is ok when every schema table is present (fresh migrated DB)', () => {
       const f = checkSchemaDrift(db);
       expect(f.status).toBe('ok');
-      expect(f.summary).toContain('schema tables present');
+      expect(f.summary).toContain('schema tables');
     });
 
     it('fails and names a table the running CLI expects but the DB lacks', () => {
@@ -435,6 +480,32 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
       expect(f.detail.join(' ')).toContain('dns_internal_records');
       expect(f.remediation).toContain('migrations');
     });
+
+    // celilo#604: this is the state the rollout could not check. Every table
+    // is present, one MIGRATED COLUMN is not, and the doctor must not call
+    // that "migrations applied".
+    it('fails and names a migrated COLUMN the DB lacks, with every table present', () => {
+      db.$client.run('ALTER TABLE backups DROP COLUMN pid');
+      const f = checkSchemaDrift(db);
+      expect(f.status).toBe('fail');
+      expect(f.detail.join(' ')).toContain('backups.pid');
+      expect(f.summary).not.toContain('present');
+    });
+
+    it('says it checked columns, not only tables', () => {
+      const f = checkSchemaDrift(db);
+      expect(f.status).toBe('ok');
+      expect(f.summary).toContain('columns present');
+    });
+
+    it('fails when a journal migration has not been applied on this box', () => {
+      db.$client.run(
+        'DELETE FROM `__drizzle_migrations` WHERE created_at = (SELECT MAX(created_at) FROM `__drizzle_migrations`)',
+      );
+      const f = checkSchemaDrift(db);
+      expect(f.status).toBe('fail');
+      expect(f.detail.join(' ')).toContain('unapplied migration');
+    });
   });
 });
 

package/src/services/fleet-checks.ts

@@ -20,7 +20,8 @@
 import type { Bus } from '@celilo/event-bus';
 import { inArray } from 'drizzle-orm';
 import { getModuleStoragePath } from '../config/paths';
-import type { DbClient } from '../db/client';
+import { type DbClient, findMigrationsFolder } from '../db/client';
+import { getMigrationStatus } from '../db/migration-status';
 import { capabilities as capabilitiesTable, modules } from '../db/schema';
 import { findSchemaDrift } from '../db/schema-introspection';
 import { loadControlPlaneSubnet, resolveFirewallNatIp } from '../hooks/capability-loader';
@@ -30,7 +31,13 @@ import type { ModuleManifest } from '../manifest/schema';
 const CONTROL_PLANE_MODULE = 'celilo-mgmt';
 import { getModuleSystems } from './deployed-systems';
 import { listDnsInternalRecords } from './dns-internal-records';
-import { type SupervisorPlatform, readInstalledUnit } from './events-daemon';
+import {
+  SUPERVISOR_SCOPES,
+  type SupervisorPlatform,
+  type SupervisorScope,
+  readInstalledUnit,
+  unitMainPid,
+} from './events-daemon';
 import { resolveSubscription } from './module-subscriptions';
 
 /**
@@ -107,26 +114,43 @@ function worst(statuses: FleetFindingStatus[]): FleetFindingStatus {
  * its schema is current, so presence is the honest signal.
  */
 export function checkSchemaDrift(db: DbClient): FleetFinding {
-  const { missingTables, missingColumns, tableCount } = findSchemaDrift(db.$client);
+  const { missingTables, missingColumns, tableCount, columnCount } = findSchemaDrift(db.$client);
 
   const detail: string[] = [];
   if (missingTables.length > 0) detail.push(`missing table(s): ${missingTables.join(', ')}`);
   if (missingColumns.length > 0) detail.push(`missing column(s): ${missingColumns.join(', ')}`);
+
+  // Also name unapplied migrations. Presence is the honest signal for schema
+  // objects, but a migration can carry an index or a data fix that presence
+  // can't see — and an operator reading "migrations applied" deserves to know
+  // when some aren't (celilo#604). Best-effort: an install layout where the
+  // journal can't be found must not fail the check.
+  let pending: string[] = [];
+  try {
+    pending = getMigrationStatus(db.$client, findMigrationsFolder()).pending;
+  } catch {
+    // No journal reachable — the presence check above still stands.
+  }
+  if (pending.length > 0) detail.push(`unapplied migration(s): ${pending.join(', ')}`);
+
   const status: FleetFindingStatus = detail.length > 0 ? 'fail' : 'ok';
 
   return {
     id: 'schema',
     title: 'database schema matches the running CLI (migrations applied)',
     status,
+    // Say tables AND columns: "all 35 tables present" reads as though columns
+    // went unchecked, which is what sent a rollout to sqlite3 over SSH to
+    // confirm a column migration the doctor had in fact already verified.
     summary:
       status === 'ok'
-        ? `all ${tableCount} schema tables present`
+        ? `all ${tableCount} schema tables and ${columnCount} columns present, no unapplied migrations`
         : 'database schema is behind the running CLI — migrations not applied',
     detail,
     remediation:
       status === 'ok'
         ? null
-        : 'run `celilo system migrate` to apply pending migrations on this box — see ISS-0100',
+        : 'run `celilo system migrate` to apply pending migrations on this box (`celilo system migrate --status` names them) — see ISS-0100',
     autoFixable: false,
   };
 }
@@ -152,6 +176,14 @@ export interface DispatcherCheckOptions {
   /** Override for readInstalledUnit — tests point this at a temp home. */
   home?: string;
   platform?: SupervisorPlatform;
+  /** Prefix for system-scope unit paths. Test seam — see getDaemonUnitPath. */
+  systemRoot?: string;
+  /**
+   * Which pid each scope's unit supervises. Injected so the check is testable
+   * without systemd. Returning null means "can't tell" — the check then makes
+   * no supervision claim rather than guessing.
+   */
+  unitMainPid?: (scope: SupervisorScope) => number | null;
 }
 
 /**
@@ -208,16 +240,69 @@ export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): Fl
     remediations.push('`celilo events repair` to sweep stuck deliveries');
   }
 
-  // (2) supervised — a unit file exists (user or system scope). A
-  // running dispatcher with NO unit is the orphan case: works now, gone
-  // after reboot.
-  const supervised =
-    readInstalledUnit({ scope: 'user', home: opts.home, platform: opts.platform }).exists ||
-    readInstalledUnit({ scope: 'system', home: opts.home, platform: opts.platform }).exists;
-  if (!supervised) {
+  // (1b) sole — a duplicate dispatcher can no longer START (it refuses), but one
+  // stranded before that shipped keeps running, and it makes every other check
+  // here ambiguous: `hb` is whichever of them wrote last. Fail rather than warn —
+  // celilo-mgr ran two for 40 days precisely because nothing reported it (#580).
+  if (health.dispatcherCount > 1) {
+    statuses.push('fail');
+    const pids = health.dispatchers.map((d) => d.pid).join(', ');
+    detail.push(
+      `${health.dispatcherCount} dispatchers are live on this bus (pids ${pids}) — only one may run`,
+    );
+    remediations.push(
+      'stop the unsupervised one: compare `systemctl show celilo-events.service -p MainPID` against those pids and kill the pid systemd does not own',
+    );
+  }
+
+  // (2) supervised — not just "a unit file exists on disk", but "the process
+  // that is actually running IS the one an installed unit supervises".
+  //
+  // The file-exists test this replaces reported green on celilo-mgr while the
+  // system unit was dead and a user-scope unit of the SAME NAME served
+  // production (#610). A check whose entire job is catching an unsupervised
+  // dispatcher cannot be satisfied by a file nobody is running.
+  const installedScopes = SUPERVISOR_SCOPES.filter(
+    (scope) =>
+      readInstalledUnit({
+        scope,
+        home: opts.home,
+        platform: opts.platform,
+        systemRoot: opts.systemRoot,
+      }).exists,
+  );
+  if (installedScopes.length === 0) {
     statuses.push('warn');
     detail.push('not under a supervisor unit — will not survive a reboot (orphan process)');
     remediations.push('`celilo events install-daemon` then enable the unit so it is supervised');
+  } else {
+    if (installedScopes.length > 1) {
+      statuses.push('fail');
+      detail.push(
+        'both a user-scope AND a system-scope unit are installed — same unit name, different services; ' +
+          'one will lose the race on every boot and retry forever',
+      );
+      remediations.push(
+        'keep exactly one: `celilo events uninstall-daemon` (user) or `celilo events uninstall-daemon --system`, and disable it in systemd',
+      );
+    }
+    // Only accuse when systemd actually answered. A null probe is ignorance,
+    // not evidence of an orphan.
+    const probe =
+      opts.unitMainPid ?? ((scope: SupervisorScope) => unitMainPid(scope, opts.platform));
+    const supervisedPids = installedScopes
+      .map((scope) => ({ scope, pid: probe(scope) }))
+      .filter((entry): entry is { scope: SupervisorScope; pid: number } => entry.pid !== null);
+    if (supervisedPids.length > 0 && !supervisedPids.some((entry) => entry.pid === hb.pid)) {
+      statuses.push('fail');
+      detail.push(
+        `the running dispatcher (pid ${hb.pid}) is not the process any installed unit supervises ` +
+          `(${supervisedPids.map((e) => `${e.scope}=${e.pid}`).join(', ')}) — restarting the unit will not restart it`,
+      );
+      remediations.push(
+        'stop the unsupervised process and let the unit own the dispatcher, or reinstall the unit for the scope that is actually running it',
+      );
+    }
   }
 
   // (3) current — started before the installed code was last written ⇒

package/src/services/interview-errors.ts

@@ -0,0 +1,20 @@
+/**
+ * The one error type that means "this interview question could not be
+ * answered". Its own module so `responder-probe` (no responder listening) and
+ * `bus-interview` (a responder replied that it couldn't decide) can both throw
+ * it without importing each other.
+ *
+ * Callers catch this to distinguish an *unanswered* question from an answered
+ * one — the distinction `module update` conflated when it reported a breaking
+ * update as "operator declined" that no operator had ever seen.
+ */
+export class InterviewUnansweredError extends Error {
+  constructor(
+    /** The interview event type that went unanswered, e.g. `interview.required.<scope>.<key>`. */
+    readonly queryType: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = 'InterviewUnansweredError';
+  }
+}

package/src/services/module-operations.test.ts

@@ -7,9 +7,12 @@ import { closeDb } from '../db/client';
 import { runMigrations } from '../db/migrate';
 import {
   InFlightError,
+  OPERATIONS_SWEEP_PATTERN,
+  OPERATIONS_SWEEP_SUBSCRIBER,
   OPERATION_TTL_MS,
   checkInFlight,
   completeOperation,
+  ensureOperationsSweepSubscriber,
   failOperation,
   isPidRunnable,
   refuseIfInFlight,
@@ -213,3 +216,22 @@ describe('module-operations', () => {
     });
   });
 });
+
+describe('ensureOperationsSweepSubscriber', () => {
+  it('registers the hourly reclaim against the existing clear command', () => {
+    const calls: Array<{ name: string; pattern: string; handler: string; registeredBy?: string }> =
+      [];
+    ensureOperationsSweepSubscriber({ subscribe: (options) => calls.push(options) });
+
+    expect(calls).toEqual([
+      {
+        name: OPERATIONS_SWEEP_SUBSCRIBER,
+        pattern: OPERATIONS_SWEEP_PATTERN,
+        handler: 'celilo module operations clear',
+        registeredBy: 'celilo-module-operations',
+      },
+    ]);
+    // Finer than the TTL, so a wedged row never survives long.
+    expect(OPERATIONS_SWEEP_PATTERN).toBe('timer.tick.1h');
+  });
+});

package/src/services/module-operations.ts

@@ -26,7 +26,8 @@
  * lock for 20 days and blocked every backup on the fleet.
  *
  * Stale rows are ignored rather than deleted; `celilo module operations`
- * lists them and `... clear` sweeps them.
+ * lists them and `... clear` sweeps them — on an hourly bus tick, not
+ * only when a human remembers (see `ensureOperationsSweepSubscriber`).
  */
 
 import { spawnSync } from 'node:child_process';
@@ -119,6 +120,52 @@ export function isPidRunnable(pid: number): boolean {
   return state !== 'T' && state !== 'Z';
 }
 
+/**
+ * The `errorMessage` written when a row is released as abandoned.
+ *
+ * Load-bearing, not cosmetic: releasing marks rows `failed` rather than
+ * deleting them, and this exact string is what later distinguishes "the
+ * operation reported a failure" from "the operation never reported
+ * anything and the sweep reclaimed it". The abandoned-operations audit
+ * counts rows by it (`services/audit/abandoned-operations.ts`).
+ */
+export const ABANDONED_RELEASE_MESSAGE = 'abandoned — released by "celilo module operations clear"';
+
+/**
+ * Reclaim abandoned rows on a schedule instead of when a human remembers.
+ *
+ * Registered as an ordinary bus subscriber whose handler is the existing
+ * `celilo module operations clear`, exactly like the backup sweep
+ * (`services/backup-sweep.ts`) — no new command and no new scheduler.
+ * Hourly is far finer than the two-hour TTL, so a wedge never survives
+ * long, and clearing is idempotent: a pass with nothing abandoned is a
+ * single read.
+ *
+ * `clear` without `--all` only touches rows that `checkInFlight` already
+ * ignores, so the sweep can never release a lock a live operation holds.
+ */
+export const OPERATIONS_SWEEP_SUBSCRIBER = 'celilo-operations-sweep';
+export const OPERATIONS_SWEEP_PATTERN = 'timer.tick.1h';
+
+export interface SubscriberRegistrar {
+  subscribe(options: {
+    name: string;
+    pattern: string;
+    handler: string;
+    registeredBy?: string;
+  }): unknown;
+}
+
+/** Idempotent: `bus.subscribe` upserts by name. */
+export function ensureOperationsSweepSubscriber(bus: SubscriberRegistrar): void {
+  bus.subscribe({
+    name: OPERATIONS_SWEEP_SUBSCRIBER,
+    pattern: OPERATIONS_SWEEP_PATTERN,
+    handler: 'celilo module operations clear',
+    registeredBy: 'celilo-module-operations',
+  });
+}
+
 export interface InFlightConflict {
   operation: ModuleOperation;
   /** A short, operator-readable description: "deploy of homebridge (pid 12345)". */

package/src/services/module-subscriptions.test.ts

@@ -173,7 +173,7 @@ describe('register / unregister roundtrip', () => {
     try {
       const row = bus.db
         .query<{ name: string; pattern: string; handler: string }, []>(
-          'SELECT name, pattern, handler FROM subscribers',
+          "SELECT name, pattern, handler FROM subscribers WHERE name = 'celilo-backup-sweep'",
         )
         .get();
       expect(row).toEqual({
@@ -186,6 +186,28 @@ describe('register / unregister roundtrip', () => {
     }
   });
 
+  // Any module can hold the operation lock, so registering ANY module — even
+  // one with no subscriptions and no backup hook — is enough to arm the sweep
+  // that reclaims abandoned rows (#581).
+  it('arms the abandoned-operations sweep for any module', () => {
+    registerModuleSubscriptions(baseManifest({}), '/p');
+
+    const bus = openBus({ dbPath, events: defineEvents({}) });
+    try {
+      const row = bus.db
+        .query<{ pattern: string; handler: string }, []>(
+          "SELECT pattern, handler FROM subscribers WHERE name = 'celilo-operations-sweep'",
+        )
+        .get();
+      expect(row).toEqual({
+        pattern: 'timer.tick.1h',
+        handler: 'celilo module operations clear',
+      });
+    } finally {
+      bus.close();
+    }
+  });
+
   it('registers each subscription as a row, names scoped to module id', () => {
     const result = registerModuleSubscriptions(
       baseManifest({
@@ -210,7 +232,7 @@ describe('register / unregister roundtrip', () => {
     try {
       const rows = bus.db
         .query<{ name: string; pattern: string; handler: string }, []>(
-          'SELECT name, pattern, handler FROM subscribers ORDER BY name',
+          "SELECT name, pattern, handler FROM subscribers WHERE name LIKE '%.%' ORDER BY name",
         )
         .all();
       expect(rows).toEqual([
@@ -243,10 +265,14 @@ describe('register / unregister roundtrip', () => {
     const bus = openBus({ dbPath, events: defineEvents({}) });
     try {
       const rows = bus.db
-        .query<{ count: number }, []>('SELECT COUNT(*) AS count FROM subscribers')
+        .query<{ count: number }, []>(
+          "SELECT COUNT(*) AS count FROM subscribers WHERE name LIKE '%.%'",
+        )
         .get();
       expect(rows?.count).toBe(1);
-      const row = bus.db.query<{ handler: string }, []>('SELECT handler FROM subscribers').get();
+      const row = bus.db
+        .query<{ handler: string }, []>("SELECT handler FROM subscribers WHERE name LIKE '%.%'")
+        .get();
       expect(row?.handler).toBe('echo second');
     } finally {
       bus.close();
@@ -279,7 +305,9 @@ describe('register / unregister roundtrip', () => {
     const bus = openBus({ dbPath, events: defineEvents({}) });
     try {
       const rows = bus.db
-        .query<{ name: string }, []>('SELECT name FROM subscribers ORDER BY name')
+        .query<{ name: string }, []>(
+          "SELECT name FROM subscribers WHERE name LIKE '%.%' ORDER BY name",
+        )
         .all();
       expect(rows).toEqual([{ name: 'authentik.a' }]);
     } finally {
@@ -337,8 +365,13 @@ describe('resyncAllSubscriptions (ISS-0088)', () => {
   function subscriberNames(): string[] {
     const bus = openBus({ dbPath: busPath, events: defineEvents({}) });
     try {
+      // Module subscriptions are dot-scoped (`<module-id>.<sub-name>`); celilo's
+      // own housekeeping subscribers (the backup and operations sweeps) are not,
+      // and are not what these tests are about.
       return bus.db
-        .query<{ name: string }, []>('SELECT name FROM subscribers ORDER BY name')
+        .query<{ name: string }, []>(
+          "SELECT name FROM subscribers WHERE name LIKE '%.%' ORDER BY name",
+        )
         .all()
         .map((r) => r.name);
     } finally {

package/src/services/module-subscriptions.ts

@@ -22,6 +22,7 @@ import { getDb } from '../db/client';
 import { modules } from '../db/schema';
 import type { ModuleManifest, ModuleSubscription } from '../manifest/schema';
 import { ensureBackupSweepSubscriber } from './backup-sweep';
+import { ensureOperationsSweepSubscriber } from './module-operations';
 
 /**
  * The bus is opened by the celilo CLI without an event registry — the
@@ -82,9 +83,6 @@ function resolveHandler(sub: ModuleSubscription, moduleId: string, modulePath: s
 /**
  * Register all of a module's subscriptions on the bus. Idempotent —
  * re-running with the same manifest updates existing rows in place.
- *
- * If the module's manifest declares no subscriptions, this is a
- * cheap no-op (the bus DB isn't even touched).
  */
 export function registerModuleSubscriptions(
   manifest: ModuleManifest,
@@ -92,10 +90,14 @@ export function registerModuleSubscriptions(
 ): { registered: number } {
   const subs = manifest.subscriptions ?? [];
   const backupSweep = Boolean(manifest.hooks?.on_backup);
-  if (subs.length === 0 && !backupSweep) return { registered: 0 };
 
   const bus = openBus({ dbPath: getEventBusPath(), events: NO_SCHEMAS });
   try {
+    // Unconditional: every module can hold the operation lock (a deploy at
+    // minimum), so the first module on a fleet is what arms the sweep that
+    // reclaims abandoned rows. Idempotent.
+    ensureOperationsSweepSubscriber(bus);
+
     // A module that can be backed up is also what switches the scheduled
     // backup sweep on. Registering here rather than at system init means the
     // sweep appears the moment the fleet has something to back up, and — since

package/src/services/module-types-generator.test.ts

@@ -63,17 +63,20 @@ describe('variableTypeToTs', () => {
 });
 
 describe('generateModuleTypes', () => {
-  test('emits a file header and empty interface for a manifest with no variables', () => {
+  test('emits a file header and a no-keys alias for a manifest with no variables', () => {
     const out = generateModuleTypes(baseManifest({ id: 'empty', name: 'Empty Module' }));
     expect(out).toContain('// Generated from manifest.yml');
     expect(out).toContain('Do not edit by hand');
-    expect(out).toContain('export type EmptyConfig = {');
+    // `= {}` means "any non-nullish value", which is the opposite of an empty
+    // config surface — and biome bans it (lint/complexity/noBannedTypes).
+    expect(out).toContain('export type EmptyConfig = Record<string, never>;');
+    expect(out).not.toContain('export type EmptyConfig = {');
     expect(out).toContain('(No variables declared — module has no typed config surface)');
   });
 
   test('produces the right type-alias name from a kebab-case module ID', () => {
     const out = generateModuleTypes(baseManifest({ id: 'dns-external', name: 'DNS External' }));
-    expect(out).toContain('export type DnsExternalConfig = {');
+    expect(out).toContain('export type DnsExternalConfig =');
   });
 
   test('renders required fields as non-optional', () => {

package/src/services/module-types-generator.ts

@@ -145,8 +145,6 @@ export function generateModuleTypes(manifest: ModuleManifest): string {
   lines.push(' * gives type aliases an implicit index signature but withholds one from');
   lines.push(' * interfaces (which can be declaration-merged). See v2/issues.');
   lines.push(' */');
-  lines.push(`export type ${typeName} = {`);
-
   const ownsFields: string[] = [];
   const importsFields: string[] = [];
 
@@ -172,6 +170,17 @@ export function generateModuleTypes(manifest: ModuleManifest): string {
     importsFields.push(...rendered);
   }
 
+  if (ownsFields.length === 0 && importsFields.length === 0) {
+    // `= {}` is the banned "any non-nullish value" type, not "no keys" — and an
+    // empty config surface means exactly no keys.
+    lines.push('// (No variables declared — module has no typed config surface)');
+    lines.push(`export type ${typeName} = Record<string, never>;`);
+    lines.push('');
+    return lines.map((line) => line.trimEnd()).join('\n');
+  }
+
+  lines.push(`export type ${typeName} = {`);
+
   if (ownsFields.length > 0) {
     lines.push('  // Module-owned variables (from variables.owns)');
     lines.push(...ownsFields);
@@ -183,12 +192,8 @@ export function generateModuleTypes(manifest: ModuleManifest): string {
     lines.push(...importsFields);
   }
 
-  if (ownsFields.length === 0 && importsFields.length === 0) {
-    lines.push('  // (No variables declared — module has no typed config surface)');
-  }
-
   lines.push('};');
   lines.push('');
 
-  return lines.join('\n');
+  return lines.map((line) => line.trimEnd()).join('\n');
 }

package/src/services/remote-responder.test.ts

@@ -76,3 +76,73 @@ test('answers responder.probe with kind daemon', async () => {
     responder.close();
   }
 }, 15_000);
+
+/**
+ * When the client can't reach a decider it says so. The responder must relay
+ * that as an error reply — the waiting command then fails loudly instead of the
+ * question quietly resolving to `defaultValue`, which is how a breaking update
+ * came to be recorded as "operator declined".
+ */
+test('an ask that cannot be answered replies with an error, not the default', async () => {
+  const responder = startRemoteResponder({
+    busDbPath,
+    ask: async () => {
+      throw new Error("stdin isn't a terminal and no answer was pre-staged");
+    },
+  });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    const replies = (await bus.query(
+      'interview.required.module-upgrade:iptables.apply_breaking' as never,
+      {
+        scope: 'module-upgrade:iptables',
+        key: 'apply_breaking',
+        kind: 'confirm',
+        message: 'Apply breaking update for iptables?',
+        required: true,
+        defaultValue: 'false',
+      } as never,
+      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
+    )) as BusEvent[];
+
+    expect(replies).toHaveLength(1);
+    const payload = replies[0].payload as { value?: unknown; error?: string };
+    expect(payload.value).toBeUndefined();
+    expect(payload.error).toContain('terminal');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);
+
+test('forwards the question scope/key so a client can pre-stage an answer', async () => {
+  const asked: WireInterview[] = [];
+  const responder = startRemoteResponder({
+    busDbPath,
+    ask: async (iv) => {
+      asked.push(iv);
+      return true;
+    },
+  });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    await bus.query(
+      'interview.required.module-upgrade:iptables.apply_breaking' as never,
+      {
+        scope: 'module-upgrade:iptables',
+        key: 'apply_breaking',
+        kind: 'confirm',
+        message: 'Apply breaking update for iptables?',
+        required: true,
+      } as never,
+      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
+    );
+    expect(asked[0].scope).toBe('module-upgrade:iptables');
+    expect(asked[0].key).toBe('apply_breaking');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);