@celilo/cli 0.18.0 → 0.20.0

package/src/cli/commands/events.ts

@@ -9,7 +9,8 @@
  *   status               bus.health() as JSON
  *   tail                 recent events
  *   list-subscribers     persistent subscribers
- *   list-pending         pending deliveries
+ *   list-pending         pending deliveries (subscriber fan-out — NOT questions)
+ *   list-unanswered      interview questions nobody has answered yet
  *   drain                process pending deliveries once
  *   run                  long-running dispatcher (foreground; SIGINT to stop)
  *   emit <type> [json]   emit an event (operator/test path; bypasses schema)
@@ -20,7 +21,9 @@
  *   resume               alias for repair (acknowledges halt-on-recovery)
  */
 
+import { spawnSync } from 'node:child_process';
 import {
+  BUS_VERSION,
   defineEvents,
   drainOnce,
   openBus,
@@ -28,6 +31,7 @@ import {
   runDispatcher,
 } from '@celilo/event-bus';
 import { eq } from 'drizzle-orm';
+import { sessionParkedOn } from '../../api/sessions';
 import { getEventBusPath, shortenPath } from '../../config/paths';
 import { getDb } from '../../db/client';
 import { modules } from '../../db/schema';
@@ -37,10 +41,15 @@ import type { HookName } from '../../hooks/types';
 import type { ModuleManifest } from '../../manifest/schema';
 import type { EnsureRequiredPayload } from '../../services/bus-interview';
 import {
+  detectPlatform,
   installDaemon,
   planDaemonInstall,
   readInstalledUnit,
+  resolveRestartScope,
+  restartDaemon,
+  supervisorCommands,
   uninstallDaemon,
+  unitInstalledInAnyScope,
 } from '../../services/events-daemon';
 import { getArg, hasFlag } from '../parser';
 import type { CommandResult } from '../types';
@@ -234,6 +243,57 @@ export async function handleEventsListPending(
   }
 }
 
+/** One unanswered interview question, as `events list-unanswered` reports it. */
+export interface UnansweredInterview {
+  eventId: number;
+  type: string;
+  family: InterviewFamily;
+  /** `<scope>.<key>` — the identity a responder pre-stages an answer under. */
+  key: string;
+  question: string;
+  ageMs: number;
+  /** The parked api-serve session waiting on this answer, if any. */
+  sessionId: string | null;
+}
+
+/**
+ * `celilo events list-unanswered` — interview queries with no correlated reply:
+ * what is waiting on a decision right now.
+ *
+ * The instrument celilo#609 lacked. `events list-pending` was reached for and
+ * silently answered a different question (it reads subscriber *deliveries*), so
+ * a parked command looked like no command at all. Non-empty here for as long as
+ * something is parked is the recurrence gate for that whole class of bug.
+ */
+export async function handleEventsListUnanswered(
+  _args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const bus = openCliBus();
+  try {
+    const limit = flags.limit ? Number(flags.limit) : 50;
+    const now = Date.now();
+    const rows: UnansweredInterview[] = [];
+    for (const event of bus.unansweredQueries({ limit })) {
+      const family = interviewFamily(event.type);
+      if (!family) continue; // e.g. responder.probe — not a question for an operator.
+      const payload = (event.payload ?? {}) as { message?: string; description?: string };
+      rows.push({
+        eventId: event.id,
+        type: event.type,
+        family,
+        key: event.type.slice(`${family}.required.`.length),
+        question: payload.message ?? payload.description ?? event.type,
+        ageMs: now - event.emittedAt,
+        sessionId: sessionParkedOn(String(event.id))?.sessionId ?? null,
+      });
+    }
+    return jsonResult(rows);
+  } finally {
+    bus.close();
+  }
+}
+
 export async function handleEventsDrain(
   _args: string[],
   flags: Record<string, string | boolean>,
@@ -405,9 +465,12 @@ function interviewFamily(type: string): InterviewFamily | null {
 /**
  * `celilo events reply <query-event-id> <value-json>` — answer ONE pending
  * interview query by its event id. The one-shot reply primitive a
- * `claude-config-responder` uses: read the question with
- * `events tail --type 'config.required.*'`, ask the operator, emit the answer
- * here. Unlike `events respond` (which must be subscribed BEFORE the query is
+ * `claude-config-responder` uses: find the question with
+ * `celilo events list-unanswered`, ask the operator, emit the answer here.
+ * (It used to say "read the log with `events tail --type '…'`" — hand-scraping
+ * the log because no command listed unanswered questions. `list-unanswered` is
+ * that command; it also names the parked session, which `tail` cannot.)
+ * Unlike `events respond` (which must be subscribed BEFORE the query is
  * emitted — bus watches don't replay history) this looks the query up by id
  * and emits a correlated reply carrying `replyFor`, which plain `events emit`
  * can't set.
@@ -897,6 +960,89 @@ export async function handleEventsUninstallDaemon(
   }
 }
 
+/**
+ * `celilo events restart-daemon` — cycle the dispatcher through its supervisor
+ * and PROVE the new process is live on the installed code (celilo#604).
+ *
+ * The interesting case is the orphan: a dispatcher the supervisor doesn't own
+ * can't be killed by `systemctl restart`, and the one-dispatcher-per-bus guard
+ * (#584) then crash-loops the unit while the old code keeps serving. So this
+ * stops unmanaged dispatchers first, and verifies on the bus afterwards rather
+ * than trusting systemctl's exit code.
+ */
+export async function handleEventsRestartDaemon(
+  _args: string[],
+  flags: Record<string, string | boolean>,
+): Promise<CommandResult> {
+  const bus = openCliBus();
+  try {
+    const platform = detectPlatform();
+    // No unit installed at all. apt-upgrade runs this on every box, including
+    // ones that never installed the daemon — failing those would break an
+    // upgrade that has nothing stale to fix. Distinguish the two cases:
+    // nothing running is a genuine no-op; something running is unsupervised
+    // and may be stale, and there is no supervisor to cycle it through.
+    if (!flags.system && !unitInstalledInAnyScope(platform)) {
+      const live = bus.liveDispatchers();
+      if (live.length === 0) {
+        return {
+          success: true,
+          message: 'No supervisor unit installed and no dispatcher running — nothing to restart.',
+        };
+      }
+      return {
+        success: false,
+        error: `A dispatcher is running unsupervised (pid ${live.map((d) => d.pid).join(', ')}, code v${live[0]?.version ?? '?'}) and no supervisor unit is installed, so it cannot be cycled — it may be serving stale code. Run \`celilo events install-daemon\`, enable the unit, then retry.`,
+      };
+    }
+    const scope = resolveRestartScope({ platform, scope: flags.system ? 'system' : undefined });
+    const cmds = supervisorCommands(platform, scope);
+    const result = await restartDaemon(
+      { platform, scope, expectedVersion: BUS_VERSION },
+      {
+        liveDispatchers: () =>
+          bus.liveDispatchers().map((d) => ({ pid: d.pid, version: d.version })),
+        supervisorPid: () => {
+          if (!cmds.mainPid) return null;
+          const out = spawnSync(cmds.mainPid[0], cmds.mainPid.slice(1), { encoding: 'utf-8' });
+          const pid = Number((out.stdout ?? '').trim());
+          return Number.isInteger(pid) && pid > 0 ? pid : null;
+        },
+        kill: (pid, signal) => {
+          try {
+            process.kill(pid, signal);
+          } catch {
+            // Already gone, or not ours to signal — the bus poll is the arbiter.
+          }
+        },
+        restartUnit: () => {
+          const out = spawnSync(cmds.restart[0], cmds.restart.slice(1), { encoding: 'utf-8' });
+          if (out.status !== 0) {
+            throw new Error(
+              `${cmds.restart.join(' ')} failed (exit ${out.status ?? 'signal'}): ${(out.stderr ?? '').trim()}`,
+            );
+          }
+        },
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+      },
+    );
+    const lines = [
+      `Dispatcher restarted under the ${result.scope}-scope unit: ${shortenPath(result.unitPath)}`,
+      `  now running: pid ${result.dispatcher.pid}, code v${result.dispatcher.version}`,
+      ...(result.orphansKilled.length > 0
+        ? [
+            `  stopped ${result.orphansKilled.length} unsupervised dispatcher(s): pid ${result.orphansKilled.join(', ')}`,
+          ]
+        : []),
+    ];
+    return { success: true, message: lines.join('\n'), data: result };
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    bus.close();
+  }
+}
+
 /**
  * `celilo events show-daemon` — print whatever unit file is currently
  * installed (`--system` for the system-scope unit) so the operator can

package/src/cli/commands/module-update.test.ts

@@ -11,7 +11,7 @@ import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import { type DbClient, getDb } from '../../db/client';
 import { modules } from '../../db/schema';
-import { classifyVersionChange, updateOne } from './module-update';
+import { classifyVersionChange, handleModuleUpdate, updateOne } from './module-update';
 
 describe('classifyVersionChange', () => {
   test('identical versions are up-to-date', () => {
@@ -250,3 +250,74 @@ subscriptions:
     }
   });
 });
+
+/**
+ * Regression for the fabricated decline: driven headlessly with no responder,
+ * the registry sweep reported a breaking update as "operator declined" — a
+ * decision nobody was asked to make. An unanswerable question is not a "no".
+ */
+describe('registry sweep — an unanswered breaking update is not a decline', () => {
+  let tempDir: string;
+  let server: ReturnType<typeof Bun.serve>;
+  let registryUrl: string;
+
+  beforeEach(() => {
+    tempDir = mkdtempSync(join(tmpdir(), 'celilo-sweep-'));
+    process.env.CELILO_DB_PATH = join(tempDir, 'test.db');
+    process.env.CELILO_ORIGINAL_CWD = tempDir;
+    // Isolated bus with no responder attached — the headless case.
+    process.env.EVENT_BUS_DB = join(tempDir, 'events.db');
+
+    getDb()
+      .insert(modules)
+      .values({
+        id: 'iptables',
+        name: 'iptables',
+        sourcePath: join(tempDir, 'installed'),
+        version: '1.0.2+9',
+        manifestData: {
+          celilo_contract: '1.0',
+          id: 'iptables',
+          name: 'iptables',
+          version: '1.0.2',
+        },
+      })
+      .run();
+
+    // Minimal sparse-index server offering a major bump for `iptables`.
+    server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        const path = new URL(req.url).pathname;
+        if (path === '/index/ip/ta/iptables') {
+          return new Response(
+            `${JSON.stringify({ name: 'iptables', vers: '2.0.0+1', deps: [], cksum: 'x' })}\n`,
+          );
+        }
+        return new Response('not found', { status: 404 });
+      },
+    });
+    registryUrl = `http://localhost:${server.port}`;
+  });
+
+  afterEach(() => {
+    server.stop(true);
+    rmSync(tempDir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+    process.env.CELILO_ORIGINAL_CWD = undefined;
+    process.env.EVENT_BUS_DB = undefined;
+  });
+
+  test('reports it as unanswered, never as declined, and fails the sweep', async () => {
+    const result = await handleModuleUpdate([], { registry: registryUrl });
+
+    const report = result.success ? (result.message ?? '') : (result.error ?? '');
+    expect(report).not.toContain('operator declined');
+    expect(report).toContain('NOT declined');
+    expect(report).toContain('iptables');
+    // A breaking update that silently didn't land must not read as success.
+    expect(result.success).toBe(false);
+    // And the module is still on the old version — no accidental upgrade.
+    expect(getDb().select().from(modules).all()[0].version).toBe('1.0.2+9');
+  });
+});

package/src/cli/commands/module-update.ts

@@ -23,6 +23,7 @@ import type { ModuleManifest } from '../../manifest/schema';
 import { cleanupTempDir, extractPackage } from '../../module/packaging/extract';
 import { RegistryClient } from '../../registry/client';
 import { askConfirm, withInterviewSession } from '../../services/bus-interview';
+import { InterviewAbandonedError, InterviewUnansweredError } from '../../services/interview-errors';
 import { getFlag } from '../parser';
 import { log } from '../prompts';
 import type { CommandResult } from '../types';
@@ -496,7 +497,9 @@ async function runRegistrySweep(
   }
 
   let appliedBreaking = 0;
-  let skippedBreaking = 0;
+  let declinedBreaking = 0;
+  const unanswered: Array<{ moduleId: string; error: string }> = [];
+  const abandoned: Array<{ moduleId: string; error: string }> = [];
 
   if (breaking.length > 0) {
     log.info('\nBreaking updates available — review required (semver-major bump):');
@@ -508,16 +511,39 @@ async function runRegistrySweep(
     log.message('Each breaking update will be applied only on explicit confirmation.\n');
 
     for (const plan of breaking) {
-      const proceed = await withInterviewSession(() =>
-        askConfirm({
-          scope: `module-upgrade:${plan.moduleId}`,
-          key: 'apply_breaking',
-          message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
-          defaultValue: false,
-        }),
-      );
+      let proceed: boolean;
+      try {
+        proceed = await withInterviewSession(() =>
+          askConfirm({
+            scope: `module-upgrade:${plan.moduleId}`,
+            key: 'apply_breaking',
+            message: `Apply breaking update for ${plan.moduleId} (${plan.installedVersion} → ${plan.targetVersion})?`,
+            defaultValue: false,
+          }),
+        );
+      } catch (err) {
+        // Neither of these is a decline, and they are not each other either:
+        // UNANSWERED = no responder was listening at all (fail-fast probe);
+        // ABANDONED  = the question stood and its parked session expired.
+        // Record and keep going so updates already applied aren't thrown away.
+        if (err instanceof InterviewUnansweredError) {
+          unanswered.push({ moduleId: plan.moduleId, error: err.message });
+          console.log(
+            `  ? ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (major, UNANSWERED)`,
+          );
+          continue;
+        }
+        if (err instanceof InterviewAbandonedError) {
+          abandoned.push({ moduleId: plan.moduleId, error: err.message });
+          console.log(
+            `  ? ${plan.moduleId.padEnd(30)} ${plan.installedVersion} → ${plan.targetVersion}  (major, ABANDONED)`,
+          );
+          continue;
+        }
+        throw err;
+      }
       if (!proceed) {
-        skippedBreaking++;
+        declinedBreaking++;
         continue;
       }
       const result = await fetchAndUpdate(client, plan.moduleId, plan.targetVersion, db, flags);
@@ -545,8 +571,26 @@ async function runRegistrySweep(
   } else {
     summary.push('No updates applied.');
   }
-  if (skippedBreaking > 0) {
-    summary.push(`Skipped ${skippedBreaking} breaking update(s) (operator declined).`);
+  if (declinedBreaking > 0) {
+    summary.push(`Skipped ${declinedBreaking} breaking update(s) (operator declined).`);
+  }
+  if (unanswered.length > 0) {
+    summary.push(
+      `Skipped ${unanswered.length} breaking update(s) — NOT declined: the confirmation could not be answered (${unanswered
+        .map((u) => u.moduleId)
+        .join(
+          ', ',
+        )}). Re-run with a responder attached, or pre-stage the answer under "module-upgrade:<module>.apply_breaking".`,
+    );
+  }
+  if (abandoned.length > 0) {
+    summary.push(
+      `Skipped ${abandoned.length} breaking update(s) — NOT declined: the confirmation was never decided and its session expired (${abandoned
+        .map((a) => a.moduleId)
+        .join(
+          ', ',
+        )}). Answer it next time with "celilo events list-unanswered" + "celilo events reply <id> <value>".`,
+    );
   }
   if (notInRegistry.length > 0) {
     summary.push(`Not in registry (${notInRegistry.length}): ${notInRegistry.join(', ')}`);
@@ -556,16 +600,18 @@ async function runRegistrySweep(
       `Registry errors (${errored.length}): ${errored.map((e) => `${e.moduleId} — ${e.error}`).join('; ')}`,
     );
   }
-  if (failed.length > 0) {
-    return {
-      success: false,
-      error: [
-        ...summary,
-        '',
-        'Failures:',
-        ...failed.map((f) => `  ${f.moduleId}: ${f.error}`),
-      ].join('\n'),
-    };
+  if (failed.length > 0 || unanswered.length > 0 || abandoned.length > 0) {
+    const detail: string[] = [];
+    if (failed.length > 0) {
+      detail.push('', 'Failures:', ...failed.map((f) => `  ${f.moduleId}: ${f.error}`));
+    }
+    if (unanswered.length > 0) {
+      detail.push('', 'Unanswered:', ...unanswered.map((u) => `  ${u.moduleId}: ${u.error}`));
+    }
+    if (abandoned.length > 0) {
+      detail.push('', 'Abandoned:', ...abandoned.map((a) => `  ${a.moduleId}: ${a.error}`));
+    }
+    return { success: false, error: [...summary, ...detail].join('\n') };
   }
   return { success: true, message: summary.join('\n') };
 }

package/src/cli/commands/system-migrate.test.ts

@@ -1,3 +1,4 @@
+import { Database } from 'bun:sqlite';
 import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -37,4 +38,59 @@ describe('handleSystemMigrate', () => {
     const second = await handleSystemMigrate();
     expect(second.success).toBe(true);
   });
+
+  // celilo#604: the runbook asserts "applied 19 -> 20, backups.pid present".
+  // Before this, the only answer was a table COUNT, which cannot see a column.
+  describe('--status', () => {
+    it('names the applied count and the latest applied migration', async () => {
+      await handleSystemMigrate();
+      closeDb();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.message).toMatch(/Applied migrations: \d+/);
+        expect(result.message).toContain('0019_backup_pid');
+        expect(result.message).toContain('Pending:            none');
+        expect(result.message).toContain('columns');
+      }
+    });
+
+    it('reports a pending migration WITHOUT applying it', async () => {
+      await handleSystemMigrate();
+      closeDb();
+      // Rewind one migration, the way an upgrade that never ran would look.
+      const raw = new Database(process.env.CELILO_DB_PATH as string);
+      raw.run(
+        'DELETE FROM `__drizzle_migrations` WHERE created_at = (SELECT MAX(created_at) FROM `__drizzle_migrations`)',
+      );
+      raw.run('ALTER TABLE backups DROP COLUMN pid');
+      const countBefore = raw
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      raw.close();
+
+      const result = await handleSystemMigrate([], { status: true });
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('0019_backup_pid');
+        expect(result.error).toContain('backups.pid');
+      }
+
+      // A status that repaired what it reports would always read clean — the
+      // exact placebo this command exists to replace.
+      const after = new Database(process.env.CELILO_DB_PATH as string);
+      const countAfter = after
+        .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+        .get()?.c;
+      const cols = after
+        .query<{ name: string }, []>("SELECT name FROM pragma_table_info('backups')")
+        .all();
+      after.close();
+      expect(countAfter).toBe(countBefore as number);
+      expect(cols.map((c) => c.name)).not.toContain('pid');
+    });
+  });
 });

package/src/cli/commands/system-migrate.ts

@@ -10,8 +10,9 @@
 import type { Database } from 'bun:sqlite';
 import { defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../../config/paths';
-import { getDb } from '../../db/client';
+import { createDbClient, findMigrationsFolder, getDb } from '../../db/client';
 import { runMigrationsOn } from '../../db/migrate';
+import { getMigrationStatus } from '../../db/migration-status';
 import { findSchemaDrift } from '../../db/schema-introspection';
 import { ensureBackupSweepSubscriber } from '../../services/backup-sweep';
 import { ensureOperationsSweepSubscriber } from '../../services/module-operations';
@@ -62,7 +63,50 @@ function countApplied(sqlite: Database): number {
   }
 }
 
-export async function handleSystemMigrate(): Promise<CommandResult> {
+/**
+ * `celilo system migrate --status` — read-only interrogation (celilo#604).
+ *
+ * A rollout runbook that says "assert applied 19 → 20 and `backups.pid`
+ * present" needs a product surface to assert against; the table count that used
+ * to be the only answer cannot see a column migration at all.
+ */
+export function migrationStatusResult(sqlite: Database): CommandResult {
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
+  const missing = [...status.missingTables, ...status.missingColumns];
+  const lines = [
+    `Applied migrations: ${status.appliedCount}`,
+    `Latest applied:     ${status.latestApplied ?? '(none)'}`,
+    status.pending.length > 0
+      ? `Pending:            ${status.pending.join(', ')}`
+      : 'Pending:            none',
+    `Schema present:     ${status.tableCount} tables, ${status.columnCount} columns`,
+    ...(missing.length > 0 ? [`Missing:            ${missing.join(', ')}`] : []),
+  ];
+  if (status.pending.length > 0 || missing.length > 0) {
+    return {
+      success: false,
+      error: `${lines.join('\n')}\n\nRun \`celilo system migrate\` to apply pending migrations on this box.`,
+    };
+  }
+  return { success: true, message: lines.join('\n'), data: status };
+}
+
+export async function handleSystemMigrate(
+  _args: string[] = [],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  // --status must NOT migrate. getDb() auto-migrates on open, so a status that
+  // went through it would repair the very state it claims to be reporting and
+  // could never say "pending" — the placebo shape this command exists to end.
+  if (flags.status) {
+    const ro = createDbClient({ readonly: true });
+    try {
+      return migrationStatusResult(ro.$client);
+    } finally {
+      ro.$client.close();
+    }
+  }
+
   // getDb() auto-migrates on open; do it inside try so an existing DB that
   // predates the drizzle-authoritative change fails with an actionable message
   // instead of a raw migrator error.
@@ -97,9 +141,13 @@ export async function handleSystemMigrate(): Promise<CommandResult> {
 
   ensureCoreSubscribers();
 
+  // Name the latest migration, not just a table count: "35 tables" reads the
+  // same whether a column migration applied or silently did nothing (celilo#604).
+  const status = getMigrationStatus(sqlite, findMigrationsFolder());
   const lines = [
     applied > 0 ? `Applied ${applied} migration(s).` : 'Schema already up to date.',
-    `Schema current: ${drift.tableCount} tables.`,
+    `Applied migrations: ${status.appliedCount} (latest: ${status.latestApplied ?? 'none'})`,
+    `Schema current: ${drift.tableCount} tables, ${drift.columnCount} columns.`,
   ];
-  return { success: true, message: lines.join('\n') };
+  return { success: true, message: lines.join('\n'), data: status };
 }

package/src/cli/completion.ts

@@ -113,6 +113,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'list-subscribers',
       'resync-subscriptions',
       'list-pending',
+      'list-unanswered',
       'drain',
       'run',
       'run-hook',
@@ -125,6 +126,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'respond',
       'install-daemon',
       'uninstall-daemon',
+      'restart-daemon',
       'show-daemon',
     ];
     return filterSuggestions(subcommands, args[1] || '');

package/src/cli/index.ts

@@ -4,7 +4,13 @@
  * Orchestration function (Rule 10.1) - routes commands to handlers
  */
 
-import { COMMANDS, type CommandDef, resolveRemote, runRemoteClient } from '@celilo/core';
+import {
+  COMMANDS,
+  type CommandDef,
+  EXIT_BLOCKED,
+  resolveRemote,
+  runRemoteClient,
+} from '@celilo/core';
 import * as p from '@clack/prompts';
 import { CLIServerRequestSchema, parseJsonWithValidation } from '../validation/schemas';
 import {
@@ -28,9 +34,11 @@ import {
   handleEventsInstallDaemon,
   handleEventsListPending,
   handleEventsListSubscribers,
+  handleEventsListUnanswered,
   handleEventsRepair,
   handleEventsReply,
   handleEventsRespond,
+  handleEventsRestartDaemon,
   handleEventsResyncSubscriptions,
   handleEventsRun,
   handleEventsRunHook,
@@ -303,6 +311,7 @@ Subcommands:
   respond                      Run the terminal responder; answer deploy prompts from another shell
   install-daemon [--system]    Write a systemd/launchd unit for the dispatcher (--system: management-plane scope)
   uninstall-daemon [--system]  Remove the installed supervisor unit
+  restart-daemon [--system]    Restart the dispatcher and verify the new process is on current code
   show-daemon [--system]       Print the currently installed unit file
 
 Description:
@@ -1416,6 +1425,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleEventsResyncSubscriptions();
       case 'list-pending':
         return handleEventsListPending(parsed.args, parsed.flags);
+      case 'list-unanswered':
+        return handleEventsListUnanswered(parsed.args, parsed.flags);
       case 'drain':
         return handleEventsDrain(parsed.args, parsed.flags);
       case 'run':
@@ -1439,6 +1450,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleEventsInstallDaemon(parsed.args, parsed.flags);
       case 'uninstall-daemon':
         return handleEventsUninstallDaemon(parsed.args, parsed.flags);
+      case 'restart-daemon':
+        return handleEventsRestartDaemon(parsed.args, parsed.flags);
       case 'show-daemon':
         return handleEventsShowDaemon(parsed.args, parsed.flags);
       default:
@@ -2133,7 +2146,7 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
     }
 
     if (parsed.subcommand === 'migrate') {
-      return handleSystemMigrate();
+      return handleSystemMigrate(parsed.args, parsed.flags);
     }
 
     return {
@@ -2423,7 +2436,18 @@ export async function main(): Promise<void> {
   // SSH to the remote celilo-mgr and drive its api-serve over the wire.
   const remote = resolveRemote(process.argv);
   if (remote) {
-    process.exit(await runRemoteClient(remote.dest, remote.commandArgv));
+    const outcome = await runRemoteClient(remote.dest, remote.commandArgv);
+    if (outcome.status === 'blocked') {
+      // Not a failure and not a decline: the command is parked server-side on a
+      // question this client couldn't decide, and is still alive.
+      process.stderr.write(
+        `Command is parked on an unanswered question: ${outcome.question}\n` +
+          `  answer it:  celilo events reply ${outcome.eventId} <value>\n` +
+          `  it resumes server-side under session ${outcome.sessionId}\n`,
+      );
+      process.exit(EXIT_BLOCKED);
+    }
+    process.exit(outcome.exitCode);
   }
 
   // Normal single-command execution