@celilo/cli 0.18.0 → 0.19.0

package/CELILO_SUBSYSTEMS.md

@@ -232,7 +232,9 @@ Creation, scheduling and freshness. A module declares an `on_backup` hook and a
 
 ## Events
 
-- **Event bus** — `packages/event-bus/src/index.ts` — `Bus`, `openBus`, `defineEvents`, `defineHandler`, `runDispatcher`, pattern matching + timer ticks (`emitDueTimerTicks`, `retentionSweep`). **Exactly one dispatcher per bus**: `runDispatcher` refuses to start while another dispatcher's process is alive (`assertSoleDispatcher` in `dispatcher.ts`, liveness via `bus.liveDispatchers()` — `kill(pid,0)`, not heartbeat age, since a tick blocks for as long as its slowest handler). The exclusion is here rather than in the systemd unit because a stranded dispatcher can sit outside the unit's cgroup where `KillMode` cannot reach it (#580). `bus.health()` reports `dispatcherCount`/`dispatchers` and a `duplicate_dispatcher` status; `checkDispatcher` (`services/fleet-checks.ts`) fails on more than one.
+- **Migration interrogation** — `apps/celilo/src/db/migration-status.ts` — `getMigrationStatus(sqlite, migrationsFolder)` reports applied count, latest applied migration BY TAG, and pending ones by name (joining `__drizzle_migrations.created_at` to drizzle journal `when`, which is exact). Surface: `celilo system migrate --status`, which opens the DB **read-only** on purpose — `getDb()` auto-migrates on open, so a status routed through it would repair what it claims to report and could never say "pending". Paired with `findSchemaDrift` (`db/schema-introspection.ts`), which is column-aware: a table COUNT cannot distinguish "the column migration applied" from "nothing happened", which is why a rollout asserting `backups.pid` had to reach for `sqlite3` over SSH. `checkSchemaDrift` (`services/fleet-checks.ts`) fails on a missing table, a missing column, OR an unapplied journal migration, and its summary names tables AND columns so the operator can see what was checked.
+- **Event bus** — `packages/event-bus/src/index.ts` — `Bus`, `openBus`, `defineEvents`, `defineHandler`, `runDispatcher`, pattern matching + timer ticks (`emitDueTimerTicks`, `retentionSweep`). **Exactly one dispatcher per bus**: `runDispatcher` refuses to start while another dispatcher's process is alive (`assertSoleDispatcher` in `dispatcher.ts`, liveness via `bus.liveDispatchers()` — `kill(pid,0)`, not heartbeat age, since a tick blocks for as long as its slowest handler). The exclusion is here rather than in the systemd unit because a stranded dispatcher can sit outside the unit's cgroup where `KillMode` cannot reach it (#580). `bus.health()` reports `dispatcherCount`/`dispatchers` and a `duplicate_dispatcher` status; `checkDispatcher` (`services/fleet-checks.ts`) fails on more than one. **Supervision** (`services/events-daemon.ts`): the unit is named `celilo-events.service` in BOTH the user and system scope, so the two are indistinguishable in every operator-facing string — `install-daemon` (which defaults to **user** scope) therefore refuses when the other scope's unit exists, and `checkDispatcher` compares the live pid against each installed unit's `MainPID` (`unitMainPid`) rather than merely testing that a unit file exists, since a file nobody is running is not supervision (#610).
+- **Dispatcher supervision (install / restart)** — `apps/celilo/src/services/events-daemon.ts` — `installDaemon`/`planDaemonInstall`/`uninstallDaemon`/`readInstalledUnit` write the systemd unit or launchd plist without touching supervisor state, and `restartDaemon` (+ pure `orphanDispatcherPids`, `resolveRestartScope`, `supervisorCommands`) is the one verb that DOES cycle it. CLI: `celilo events install-daemon|uninstall-daemon|show-daemon|restart-daemon [--system]`. `restart-daemon` exists because the dispatcher runs the code it LOADED: celilo-mgr sat 9 days on event-bus v0.1.8 after apt installed v0.2.0, running the very bug the release fixed (celilo#604). Two things make it non-trivial and both are load-bearing: (1) it stops any live dispatcher the supervisor does not own first — an ORPHAN (PPID 1) is invisible to `systemctl restart`, and `assertSoleDispatcher` then crash-loops the unit while the old code keeps serving; (2) it verifies on the BUS that a NEW pid is live reporting `BUS_VERSION`, never off systemctl's exit code, which returns 0 into exactly that crash loop. System scope shells `sudo systemctl` (the unit is root-owned; celilo runs unprivileged), covered by the scoped `/etc/sudoers.d/celilo-events-restart` conffile that `celilo-bootstrap` ships — a unit test asserts the argv and the grant cannot drift apart.
 
 ## Remote API (drive the CLI over the wire)
 
@@ -246,7 +248,7 @@ Run any celilo command on celilo-mgr over SSH instead of screen-scraping `ssh <h
 - **Access control** — `apps/celilo/src/services/api-access.ts` — `grantPrincipal`, `isAuthorized` (deny-by-default, `command:subcommand` grants), `renderAuthorizedKeys`. Table: `api_principals` (`apps/celilo/src/db/schema.ts`). CLI: `apps/celilo/src/cli/commands/api.ts` (`api grant|list|revoke|authorized-keys|key new`).
 - **Mid-run interview bridge (`kind:daemon` responder)** — `apps/celilo/src/services/remote-responder.ts` — `startRemoteResponder` bridges bus `interview.required.*` ↔ wire.
 - **Server provisioning** — the `celilo-bootstrap` deb (`packaging/celilo-bootstrap/scripts/postinst`) creates the non-root `celilo-api` landing account + sshd; membership in the `celilo` group + `/etc/sudoers.d/celilo` (`!use_pty`) gives api-serve DB access via the wrapper's sudo-drop.
-- **Self-upgrade (apt)** — `celilo apt-upgrade` (`apps/celilo/src/cli/commands/apt-upgrade.ts`) upgrades the deb-installed `celilo`/`celilo-bootstrap` packages (`apt-get update` → `--only-upgrade install`) then spawns a fresh `celilo system migrate` (ISS-0100). It's the RW target behind the MCP's registry-derived `celilo_apt_upgrade` tool; the celilo user's two apt invocations are scoped-sudo'd by `/etc/sudoers.d/celilo-apt-upgrade`, shipped by `celilo-bootstrap`. **This upgrades celilo ITSELF — not the modules it manages. For those, see Module auto-upgrade below; the two are routinely confused.**
+- **Self-upgrade (apt)** — `celilo apt-upgrade` (`apps/celilo/src/cli/commands/apt-upgrade.ts`) upgrades the deb-installed `celilo`/`celilo-bootstrap` packages (`apt-get update` → `--only-upgrade install`) then spawns a fresh `celilo system migrate` (ISS-0100), then `celilo events restart-daemon` so the dispatcher actually runs the code just installed — a failure there fails the whole command and names which steps DID complete, because "upgraded" while the dispatcher serves stale code is the silent state celilo#604 documents. It's the RW target behind the MCP's registry-derived `celilo_apt_upgrade` tool; the celilo user's two apt invocations are scoped-sudo'd by `/etc/sudoers.d/celilo-apt-upgrade`, shipped by `celilo-bootstrap`. **This upgrades celilo ITSELF — not the modules it manages. For those, see Module auto-upgrade below; the two are routinely confused.**
 - **Module auto-upgrade (registry-poll CD)** — the *pull* half of continuous deployment: celilo-mgr polls the registry and upgrades opted-in modules unattended. Spec: `openspec/specs/module-auto-upgrade/spec.md`. Entry points: `apps/celilo/src/cli/commands/module-upgrade.ts` — `runRegistryPoll` (the `--poll` path), `selectPollTargets` (pure: `autoUpgrade && latest && change ∉ {up-to-date, ahead}`), `upgradeOneModule` (update → backup → deploy → verify), `needsPreUpgradeBackup`, `pickAutoUpgrade`/`pickUpgradePolicy` (both fail closed/safe); `classifyVersionChange` in `module-update.ts` (treats a registry `+N` revision as a patch); `resolveDeployPosture` in `apps/celilo/src/services/deploy-posture.ts`. Trigger: celilo-mgmt's `registry-poll` subscription (`modules/celilo-mgmt/manifest.yml`) on `timer.tick.15m` with handler **`celilo module upgrade --poll`** — the flag is REQUIRED, since the dispatcher appends the event id positionally and a bare handler would consume it as the optional module name (silent: 3108 deliveries, 0 successes). Operator controls are framework config keys settable on ANY module (`FRAMEWORK_CONFIG_KEYS` in `module-config.ts`): `auto_upgrade` (opt-in, default false) and `upgrade_policy` (`by-semver`|`always-safe`|`always-fast`), validated at set time because both readers fail open. ⚠️ `always-safe` guarantees safe *posture*, NOT a backup — `needsPreUpgradeBackup` also requires the TARGET manifest to declare an `on_backup` hook, else it warns and proceeds. Confirm a data-bearing module declares `on_backup` before enabling `auto_upgrade` on it. The *build* half (app CI publishing a `.netapp` on merge) is not yet shipped — `openspec/changes/build-bus-poll-cd`.
 - **MCP service (`@celilo/mcp`)** — `packages/mcp/src/` — an operator-facing stdio MCP server (official `@modelcontextprotocol/sdk`, bin `celilo-mcp`) that drives a remote celilo server over the Remote API for an AI client. Two-item config (`config.ts`: `server` + `defaultUser`, env or `~/.config/celilo-mcp/config.json`). Dual-principal auth (`auth.ts`: `celilo-mcp auth setup` enrolls read-only `celilo-mcp-ro` + full `celilo-mcp-rw` ed25519 keypairs, prints the exact `celilo api grant` lines the operator runs server-side). Transport (`transport.ts`): reuses `@celilo/core` `runRemoteClient`, selecting the principal by `ssh -i <key>` and capturing structured output. Tool surface is generated LIVE from the server's command registry — `registry-fetch.ts` fetches `celilo commands --json` (+ `service list --json` for configured providers) over the RO principal on connect; `tools-from-registry.ts` (pure) projects that into one tool per runnable leaf, grouped by top-level command (`celilo_module_*`, `celilo_proxmox_*`, …), each with a Zod input schema from the leaf's args/flags and a read/write tag → RO/RW routing, plus a generic `celilo_run` escape hatch. Auto-detect hides provider-gated groups (e.g. `celilo_proxmox_*` until a Proxmox service is configured) and re-detects on a timer, emitting `notifications/tools/list_changed` when the surface changes. Coverage gate (`tests/coverage.test.ts`) asserts every registry leaf maps to a tool. Composite RO troubleshooting tools (`troubleshoot.ts` pure correlation + `troubleshoot-tools.ts` thin adapters): `celilo_assess_module <id>` and `celilo_fleet_status` correlate `celilo audit --json` (the drift backbone) with the `module list --json` roster into a per-module / fleet-wide verdict. Design: `openspec/changes/celilo-mcp-service/proposal.md`. (Distinct from the dev/ops `@celilo/mcp-server` below.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {
@@ -59,7 +59,7 @@
     "@aws-sdk/client-s3": "^3.1024.0",
     "@celilo/capabilities": "^0.10.0",
     "@celilo/cli-display": "^0.1.10",
-    "@celilo/core": "^0.3.2",
+    "@celilo/core": "^0.4.0",
     "@celilo/event-bus": "^0.2.0",
     "@clack/prompts": "^1.1.0",
     "ajv": "^8.18.0",

package/src/api/remote-client.test.ts

@@ -89,3 +89,65 @@ test('renders a forwarded interview and sends the answer back', async () => {
   expect(answer).toBeDefined();
   expect(JSON.parse(answer as string)).toEqual({ type: 'answer', id: 'q1', value: 'myhost' });
 });
+
+/**
+ * Regression for the fabricated "operator declined".
+ *
+ * The default renderer prompts with clack, which reads keypresses off stdin
+ * whether or not stdin is a terminal. Driven over the MCP (stdin = the JSON-RPC
+ * stream) the next newline submitted the prompt at its `initialValue` — the
+ * question's `defaultValue` — so a breaking update nobody saw came back as a
+ * considered "no". With no terminal the client must say it cannot answer.
+ */
+test('no TTY and no renderer → answers with an error, never the default', async () => {
+  const writes: string[] = [];
+  const encoder = new TextEncoder();
+  let controller!: ReadableStreamDefaultController<Uint8Array>;
+  const stdout = new ReadableStream<Uint8Array>({
+    start(c) {
+      controller = c;
+    },
+  });
+  const push = (obj: unknown) => controller.enqueue(encoder.encode(`${JSON.stringify(obj)}\n`));
+
+  const transport: RemoteTransport = {
+    stdin: {
+      write(chunk: string) {
+        writes.push(chunk);
+        if (chunk.includes('"answer"')) {
+          push({ type: 'result', success: false, exitCode: 1 });
+          controller.close();
+        }
+      },
+    },
+    stdout,
+    kill() {},
+    exited: Promise.resolve(1),
+  };
+
+  push({ type: 'ready', protocolVersion: 1 });
+  push({
+    type: 'interview',
+    id: 'q1',
+    scope: 'module-upgrade:iptables',
+    key: 'apply_breaking',
+    kind: 'confirm',
+    message: 'Apply breaking update for iptables (1.0.2+9 → 2.0.0+1)?',
+    defaultValue: 'false',
+  });
+
+  // No `renderInterview` — exactly what runRemoteCapture used to do. bun test
+  // runs with a piped stdin, i.e. the MCP server's situation.
+  expect(process.stdin.isTTY).toBeFalsy();
+  const code = await runRemoteClient('ignored', ['module', 'update'], {
+    openTransport: () => transport,
+    out: { write() {} },
+  });
+
+  expect(code).toBe(1);
+  const answer = writes.find((w) => w.includes('"answer"'));
+  expect(answer).toBeDefined();
+  const parsed = JSON.parse(answer as string) as { value: unknown; error?: string };
+  expect(parsed.value).not.toBe(false);
+  expect(parsed.error).toContain('module-upgrade:iptables.apply_breaking');
+});

package/src/api/serve.ts

@@ -108,14 +108,19 @@ export async function apiServeMode(principal: string): Promise<void> {
   send({ type: 'ready', protocolVersion: API_PROTOCOL_VERSION });
 
   const busDbPath = getEventBusPath();
-  const pendingAnswers = new Map<string, (value: unknown) => void>();
+  const pendingAnswers = new Map<
+    string,
+    { resolve: (value: unknown) => void; reject: (error: Error) => void }
+  >();
 
   const ask = (interview: WireInterview): Promise<unknown> =>
-    new Promise((resolve) => {
-      pendingAnswers.set(interview.id, resolve);
+    new Promise((resolve, reject) => {
+      pendingAnswers.set(interview.id, { resolve, reject });
       send({
         type: 'interview',
         id: interview.id,
+        scope: interview.scope,
+        key: interview.key,
         kind: interview.kind,
         message: interview.message,
         description: interview.description,
@@ -140,10 +145,13 @@ export async function apiServeMode(principal: string): Promise<void> {
     }
 
     if (msg.type === 'answer') {
-      const resolve = pendingAnswers.get(msg.id);
-      if (resolve) {
+      const pending = pendingAnswers.get(msg.id);
+      if (pending) {
         pendingAnswers.delete(msg.id);
-        resolve(msg.value);
+        // `error` = the client couldn't reach a decider. Fail the waiting
+        // command rather than letting the question fall back to its default.
+        if (msg.error) pending.reject(new Error(msg.error));
+        else pending.resolve(msg.value);
       }
       continue;
     }

package/src/cli/commands/apt-upgrade.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from 'bun:test';
 import { handleAptUpgrade } from './apt-upgrade';
 
 describe('handleAptUpgrade', () => {
-  test('runs the three steps in order when each succeeds', async () => {
+  test('runs every step in order when each succeeds, ending with the dispatcher restart', async () => {
     const seen: string[][] = [];
     const result = await handleAptUpgrade([], {}, (argv) => {
       seen.push(argv);
@@ -14,9 +14,28 @@ describe('handleAptUpgrade', () => {
       ['sudo', 'apt-get', 'update'],
       ['sudo', 'apt-get', '-y', '--only-upgrade', 'install', 'celilo', 'celilo-bootstrap'],
       ['/usr/local/bin/celilo', 'system', 'migrate'],
+      // celilo#604: without this, apt installs new code and the running
+      // dispatcher keeps serving the old — celilo-mgr did so for 9 days.
+      ['/usr/local/bin/celilo', 'events', 'restart-daemon'],
     ]);
   });
 
+  test('fails, and names what DID complete, when the dispatcher restart fails', async () => {
+    const result = await handleAptUpgrade([], {}, (argv) => ({
+      status: argv.includes('restart-daemon') ? 1 : 0,
+    }));
+
+    // The packages ARE upgraded and the dispatcher is NOT on the new code.
+    // Saying so in the failure is the acceptance condition — silence here is
+    // what let a stale dispatcher pass for a successful upgrade.
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error).toContain('restart the event dispatcher');
+      expect(result.error).toContain('apt-get upgrade');
+      expect(result.error).toContain('apply DB migrations');
+    }
+  });
+
   test('stops at the first failing step and does not run later ones', async () => {
     const seen: string[][] = [];
     const result = await handleAptUpgrade([], {}, (argv) => {

package/src/cli/commands/apt-upgrade.ts

@@ -34,6 +34,11 @@ const STEPS: Step[] = [
     argv: ['sudo', 'apt-get', '-y', '--only-upgrade', 'install', 'celilo', 'celilo-bootstrap'],
   },
   { label: 'apply DB migrations', argv: [CELILO_BIN, 'system', 'migrate'] },
+  // The dispatcher runs the code it LOADED, not the code on disk. Without this
+  // step celilo-mgr sat 9 days on event-bus v0.1.8 after apt installed v0.2.0,
+  // faithfully running the bug the upgrade shipped to fix (celilo#604). The
+  // upgraded binary does the restart so the verification is the new code's.
+  { label: 'restart the event dispatcher', argv: [CELILO_BIN, 'events', 'restart-daemon'] },
 ];
 
 /** Run one argv, inheriting stdio so its output streams through api-serve. */
@@ -46,18 +51,23 @@ export async function handleAptUpgrade(
   _flags: Record<string, string | boolean>,
   runStep: StepRunner = defaultRunner,
 ): Promise<CommandResult> {
+  const done: string[] = [];
   for (const step of STEPS) {
     process.stdout.write(`\n▸ ${step.label}\n`);
     const { status } = runStep(step.argv);
     if (status !== 0) {
+      // Name what DID happen. A failure on the last step means new code is
+      // installed and the dispatcher is still serving the old — the operator
+      // has to be told that in the failure itself, not left to infer it.
       return {
         success: false,
-        error: `apt-upgrade failed at "${step.label}" (exit ${status ?? 'signal'}). Nothing further was run.`,
+        error: `apt-upgrade failed at "${step.label}" (exit ${status ?? 'signal'}). Completed: ${done.length > 0 ? done.join(', ') : 'nothing'}. Nothing further was run.`,
       };
     }
+    done.push(step.label);
   }
   return {
     success: true,
-    message: 'celilo apt packages upgraded and migrations applied.',
+    message: 'celilo apt packages upgraded, migrations applied, dispatcher restarted on new code.',
   };
 }

package/src/cli/commands/events.ts

@@ -20,7 +20,9 @@
  *   resume               alias for repair (acknowledges halt-on-recovery)
  */
 
+import { spawnSync } from 'node:child_process';
 import {
+  BUS_VERSION,
   defineEvents,
   drainOnce,
   openBus,
@@ -37,10 +39,15 @@ import type { HookName } from '../../hooks/types';
 import type { ModuleManifest } from '../../manifest/schema';
 import type { EnsureRequiredPayload } from '../../services/bus-interview';
 import {
+  detectPlatform,
   installDaemon,
   planDaemonInstall,
   readInstalledUnit,
+  resolveRestartScope,
+  restartDaemon,
+  supervisorCommands,
   uninstallDaemon,
+  unitInstalledInAnyScope,
 } from '../../services/events-daemon';
 import { getArg, hasFlag } from '../parser';
 import type { CommandResult } from '../types';
@@ -897,6 +904,89 @@ export async function handleEventsUninstallDaemon(
   }
 }
 
+/**
+ * `celilo events restart-daemon` — cycle the dispatcher through its supervisor
+ * and PROVE the new process is live on the installed code (celilo#604).
+ *
+ * The interesting case is the orphan: a dispatcher the supervisor doesn't own
+ * can't be killed by `systemctl restart`, and the one-dispatcher-per-bus guard
+ * (#584) then crash-loops the unit while the old code keeps serving. So this
+ * stops unmanaged dispatchers first, and verifies on the bus afterwards rather
+ * than trusting systemctl's exit code.
+ */
+export async function handleEventsRestartDaemon(
+  _args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const bus = openCliBus();
+  try {
+    const platform = detectPlatform();
+    // No unit installed at all. apt-upgrade runs this on every box, including
+    // ones that never installed the daemon — failing those would break an
+    // upgrade that has nothing stale to fix. Distinguish the two cases:
+    // nothing running is a genuine no-op; something running is unsupervised
+    // and may be stale, and there is no supervisor to cycle it through.
+    if (!flags.system && !unitInstalledInAnyScope(platform)) {
+      const live = bus.liveDispatchers();
+      if (live.length === 0) {
+        return {
+          success: true,
+          message: 'No supervisor unit installed and no dispatcher running — nothing to restart.',
+        };
+      }
+      return {
+        success: false,
+        error: `A dispatcher is running unsupervised (pid ${live.map((d) => d.pid).join(', ')}, code v${live[0]?.version ?? '?'}) and no supervisor unit is installed, so it cannot be cycled — it may be serving stale code. Run \`celilo events install-daemon\`, enable the unit, then retry.`,
+      };
+    }
+    const scope = resolveRestartScope({ platform, scope: flags.system ? 'system' : undefined });
+    const cmds = supervisorCommands(platform, scope);
+    const result = await restartDaemon(
+      { platform, scope, expectedVersion: BUS_VERSION },
+      {
+        liveDispatchers: () =>
+          bus.liveDispatchers().map((d) => ({ pid: d.pid, version: d.version })),
+        supervisorPid: () => {
+          if (!cmds.mainPid) return null;
+          const out = spawnSync(cmds.mainPid[0], cmds.mainPid.slice(1), { encoding: 'utf-8' });
+          const pid = Number((out.stdout ?? '').trim());
+          return Number.isInteger(pid) && pid > 0 ? pid : null;
+        },
+        kill: (pid, signal) => {
+          try {
+            process.kill(pid, signal);
+          } catch {
+            // Already gone, or not ours to signal — the bus poll is the arbiter.
+          }
+        },
+        restartUnit: () => {
+          const out = spawnSync(cmds.restart[0], cmds.restart.slice(1), { encoding: 'utf-8' });
+          if (out.status !== 0) {
+            throw new Error(
+              `${cmds.restart.join(' ')} failed (exit ${out.status ?? 'signal'}): ${(out.stderr ?? '').trim()}`,
+            );
+          }
+        },
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+      },
+    );
+    const lines = [
+      `Dispatcher restarted under the ${result.scope}-scope unit: ${shortenPath(result.unitPath)}`,
+      `  now running: pid ${result.dispatcher.pid}, code v${result.dispatcher.version}`,
+      ...(result.orphansKilled.length > 0
+        ? [
+            `  stopped ${result.orphansKilled.length} unsupervised dispatcher(s): pid ${result.orphansKilled.join(', ')}`,
+          ]
+        : []),
+    ];
+    return { success: true, message: lines.join('\n'), data: result };
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    bus.close();
+  }
+}
+
 /**
  * `celilo events show-daemon` — print whatever unit file is currently
  * installed (`--system` for the system-scope unit) so the operator can

package/src/cli/commands/module-update.test.ts

@@ -11,7 +11,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../../db/client';
 import { modules } from '../../db/schema';
-import { classifyVersionChange, updateOne } from './module-update';
+import { classifyVersionChange, handleModuleUpdate, updateOne } from './module-update';
 
 describe('classifyVersionChange', () => {
   test('identical versions are up-to-date', () => {
@@ -250,3 +250,74 @@ subscriptions:
     }
   });
 });
+
+/**
+ * Regression for the fabricated decline: driven headlessly with no responder,
+ * the registry sweep reported a breaking update as "operator declined" — a
+ * decision nobody was asked to make. An unanswerable question is not a "no".
+ */
+describe('registry sweep — an unanswered breaking update is not a decline', () => {
+  let tempDir: string;
+  let server: ReturnType<typeof Bun.serve>;
+  let registryUrl: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-sweep-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+    // Isolated bus with no responder attached — the headless case.
+    process.env.EVENT_BUS_DB = join(tempDir, 'events.db');
+
+    getDb()
+      .insert(modules)
+      .values({
+        id: 'iptables',
+        name: 'iptables',
+        sourcePath: join(tempDir, 'installed'),
+        version: '1.0.2+9',
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'iptables',
+          name: 'iptables',
+          version: '1.0.2',
+        },
+      })
+      .run();
+
+    // Minimal sparse-index server offering a major bump for `iptables`.
+    server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        const path = new URL(req.url).pathname;
+        if (path === '/index/ip/ta/iptables') {
+          return new Response(
+            `${JSON.stringify({ name: 'iptables', vers: '2.0.0+1', deps: [], cksum: 'x' })}\n`,
+          );
+        }
+        return new Response('not found', { status: 404 });
+      },
+    });
+    registryUrl = `http://localhost:${server.port}`;
+  });
+
+  afterEach(() => {
+    server.stop(true);
+    rmSync(tempDir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+    process.env.CELILO_ORIGINAL_CWD = undefined;
+    process.env.EVENT_BUS_DB = undefined;
+  });
+
+  test('reports it as unanswered, never as declined, and fails the sweep', async () => {
+    const result = await handleModuleUpdate([], { registry: registryUrl });
+
+    const report = result.success ? (result.message ?? '') : (result.error ?? '');
+    expect(report).not.toContain('operator declined');
+    expect(report).toContain('NOT declined');
+    expect(report).toContain('iptables');
+    // A breaking update that silently didn't land must not read as success.
+    expect(result.success).toBe(false);
+    // And the module is still on the old version — no accidental upgrade.
+    expect(getDb().select().from(modules).all()[0].version).toBe('1.0.2+9');
+  });
+});

package/src/cli/commands/module-update.ts

@@ -23,6 +23,7 @@ import type { ModuleManifest } from '../../manifest/schema';
 import { cleanupTempDir, extractPackage } from '../../module/packaging/extract';
 import { RegistryClient } from '../../registry/client';
 import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { InterviewUnansweredError } from '../../services/interview-errors';
 import { getFlag } from '../parser';
 import { log } from '../prompts';
 import type { CommandResult } from '../types';
@@ -496,7 +497,8 @@ async function runRegistrySweep(
   }
 
   let appliedBreaking = 0;
-  let skippedBreaking = 0;
+  let declinedBreaking = 0;
+  const unanswered: Array<{ moduleId: string; error: string }> = [];
 
   if (breaking.length > 0) {
     log.info('\nBreaking updates available — review required (semver-major bump):');
@@ -508,16 +510,29 @@ async function runRegistrySweep(
     log.message('Each breaking update will be applied only on explicit confirmation.\n');
 
     for (const plan of breaking) {
-      const proceed = await withInterviewSession(() =>
-        askConfirm({
-          scope: `module-upgrade:${plan.moduleId}`,
-          key: 'apply_breaking',
-          message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
-          defaultValue: false,
-        }),
-      );
+      let proceed: boolean;
+      try {
+        proceed = await withInterviewSession(() =>
+          askConfirm({
+            scope: `module-upgrade:${plan.moduleId}`,
+            key: 'apply_breaking',
+            message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
+            defaultValue: false,
+          }),
+        );
+      } catch (err) {
+        // Nobody could answer. That is NOT a decline — record it as unanswered
+        // so the summary says so and the sweep exits non-zero, and keep going
+        // so the updates already applied aren't thrown away with a hard abort.
+        if (!(err instanceof InterviewUnansweredError)) throw err;
+        unanswered.push({ moduleId: plan.moduleId, error: err.message });
+        console.log(
+          `  ? ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (major, UNANSWERED)`,
+        );
+        continue;
+      }
       if (!proceed) {
-        skippedBreaking++;
+        declinedBreaking++;
         continue;
       }
       const result = await fetchAndUpdate(client, plan.moduleId, plan.targetVersion, db, flags);
@@ -545,8 +560,17 @@ async function runRegistrySweep(
   } else {
     summary.push('No updates applied.');
   }
-  if (skippedBreaking > 0) {
-    summary.push(`Skipped ${skippedBreaking} breaking update(s) (operator declined).`);
+  if (declinedBreaking > 0) {
+    summary.push(`Skipped ${declinedBreaking} breaking update(s) (operator declined).`);
+  }
+  if (unanswered.length > 0) {
+    summary.push(
+      `Skipped ${unanswered.length} breaking update(s) — NOT declined: the confirmation could not be answered (${unanswered
+        .map((u) => u.moduleId)
+        .join(
+          ', ',
+        )}). Re-run with a responder attached, or pre-stage the answer under "module-upgrade:<module>.apply_breaking".`,
+    );
   }
   if (notInRegistry.length > 0) {
     summary.push(`Not in registry (${notInRegistry.length}): ${notInRegistry.join(', ')}`);
@@ -556,16 +580,15 @@ async function runRegistrySweep(
       `Registry errors (${errored.length}): ${errored.map((e) => `${e.moduleId} — ${e.error}`).join('; ')}`,
     );
   }
-  if (failed.length > 0) {
-    return {
-      success: false,
-      error: [
-        ...summary,
-        '',
-        'Failures:',
-        ...failed.map((f) => `  ${f.moduleId}: ${f.error}`),
-      ].join('\n'),
-    };
+  if (failed.length > 0 || unanswered.length > 0) {
+    const detail: string[] = [];
+    if (failed.length > 0) {
+      detail.push('', 'Failures:', ...failed.map((f) => `  ${f.moduleId}: ${f.error}`));
+    }
+    if (unanswered.length > 0) {
+      detail.push('', 'Unanswered:', ...unanswered.map((u) => `  ${u.moduleId}: ${u.error}`));
+    }
+    return { success: false, error: [...summary, ...detail].join('\n') };
   }
   return { success: true, message: summary.join('\n') };
 }

package/src/cli/commands/system-migrate.test.ts

@@ -1,3 +1,4 @@
+import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -37,4 +38,59 @@ describe('handleSystemMigrate', () => {
     const second = await handleSystemMigrate();
     expect(second.success).toBe(true);
   });
+
+  // celilo#604: the runbook asserts "applied 19 -> 20, backups.pid present".
+  // Before this, the only answer was a table COUNT, which cannot see a column.
+  describe('--status', () => {
+    it('names the applied count and the latest applied migration', async () => {
+      await handleSystemMigrate();
+      closeDb();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.message).toMatch(/Applied migrations: \d+/);
+        expect(result.message).toContain('0019_backup_pid');
+        expect(result.message).toContain('Pending:            none');
+        expect(result.message).toContain('columns');
+      }
+    });
+
+    it('reports a pending migration WITHOUT applying it', async () => {
+      await handleSystemMigrate();
+      closeDb();
+      // Rewind one migration, the way an upgrade that never ran would look.
+      const raw = new Database(process.env.CELILO_DB_PATH as string);
+      raw.run(
+        'DELETE FROM `__drizzle_migrations` WHERE created_at = (SELECT MAX(created_at) FROM `__drizzle_migrations`)',
+      );
+      raw.run('ALTER TABLE backups DROP COLUMN pid');
+      const countBefore = raw
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      raw.close();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('0019_backup_pid');
+        expect(result.error).toContain('backups.pid');
+      }
+
+      // A status that repaired what it reports would always read clean — the
+      // exact placebo this command exists to replace.
+      const after = new Database(process.env.CELILO_DB_PATH as string);
+      const countAfter = after
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      const cols = after
+        .query<{ name: string }, []>("SELECT name FROM pragma_table_info('backups')")
+        .all();
+      after.close();
+      expect(countAfter).toBe(countBefore as number);
+      expect(cols.map((c) => c.name)).not.toContain('pid');
+    });
+  });
 });