@celilo/cli 0.18.0 → 0.20.0

package/src/db/migration-status.test.ts

@@ -0,0 +1,114 @@
+/**
+ * celilo#604: a table COUNT reported "up to date" for a DB missing a migrated
+ * COLUMN, so the rollout's own stop-condition was uncheckable by the tools the
+ * runbook named. These assert the column case specifically.
+ */
+
+import { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { getMigrationStatus, readMigrationJournal } from './migration-status';
+
+/** A journal + a `__drizzle_migrations` table, wired the way drizzle wires them. */
+function seed(dir: string, entries: Array<{ when: number; tag: string }>, appliedWhens: number[]) {
+  mkdirSync(join(dir, 'meta'), { recursive: true });
+  writeFileSync(
+    join(dir, 'meta', '_journal.json'),
+    JSON.stringify({ version: '7', dialect: 'sqlite', entries }),
+  );
+  const db = new Database(':memory:');
+  db.run(
+    'CREATE TABLE `__drizzle_migrations` (id INTEGER PRIMARY KEY, hash TEXT, created_at NUMERIC)',
+  );
+  for (const when of appliedWhens) {
+    db.run('INSERT INTO `__drizzle_migrations` (hash, created_at) VALUES (?, ?)', [
+      `h${when}`,
+      when,
+    ]);
+  }
+  return db;
+}
+
+describe('getMigrationStatus', () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-migstatus-'));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+  it('names the latest applied migration and every pending one', () => {
+    const db = seed(
+      dir,
+      [
+        { when: 100, tag: '0018_drop_alert_policy_snapshot' },
+        { when: 200, tag: '0019_backup_pid' },
+        { when: 300, tag: '0020_future' },
+      ],
+      [100, 200],
+    );
+
+    const status = getMigrationStatus(db, dir);
+
+    expect(status.appliedCount).toBe(2);
+    expect(status.latestApplied).toBe('0019_backup_pid');
+    expect(status.pending).toEqual(['0020_future']);
+  });
+
+  it('reports nothing pending once every journal entry is applied', () => {
+    const db = seed(dir, [{ when: 100, tag: '0000_init' }], [100]);
+    const status = getMigrationStatus(db, dir);
+    expect(status.pending).toEqual([]);
+    expect(status.latestApplied).toBe('0000_init');
+  });
+
+  it('reports a DB that has never been migrated as all-pending', () => {
+    mkdirSync(join(dir, 'meta'), { recursive: true });
+    writeFileSync(
+      join(dir, 'meta', '_journal.json'),
+      JSON.stringify({ entries: [{ when: 1, tag: '0000_init' }] }),
+    );
+    const status = getMigrationStatus(new Database(':memory:'), dir);
+    expect(status.appliedCount).toBe(0);
+    expect(status.latestApplied).toBeNull();
+    expect(status.pending).toEqual(['0000_init']);
+  });
+
+  it('counts columns, not just tables — the signal a column migration needs', () => {
+    const db = seed(dir, [], []);
+    const status = getMigrationStatus(db, dir);
+    // Every schema table is missing here, so the counts are the code's totals.
+    expect(status.tableCount).toBeGreaterThan(0);
+    expect(status.columnCount).toBeGreaterThan(status.tableCount);
+  });
+
+  it('reads journal entries oldest-first regardless of file order', () => {
+    mkdirSync(join(dir, 'meta'), { recursive: true });
+    writeFileSync(
+      join(dir, 'meta', '_journal.json'),
+      JSON.stringify({
+        entries: [
+          { when: 300, tag: 'c' },
+          { when: 100, tag: 'a' },
+        ],
+      }),
+    );
+    expect(readMigrationJournal(dir).map((e) => e.tag)).toEqual(['a', 'c']);
+  });
+
+  it('returns an empty journal when the folder has none', () => {
+    expect(readMigrationJournal(join(dir, 'nope'))).toEqual([]);
+  });
+});
+
+describe('getMigrationStatus against the real migrations folder', () => {
+  it('sees backups.pid as missing when the column migration did not land', () => {
+    // The exact celilo#604 shape: every table present, one migrated column not.
+    const db = new Database(':memory:');
+    db.run('CREATE TABLE backups (id TEXT PRIMARY KEY)');
+    const status = getMigrationStatus(db, join(import.meta.dir, '../../drizzle'));
+    expect(status.missingColumns).toContain('backups.pid');
+    expect(status.pending).toContain('0019_backup_pid');
+  });
+});

package/src/db/migration-status.ts

@@ -0,0 +1,78 @@
+/**
+ * Read-only migration interrogation (celilo#604).
+ *
+ * `system migrate` used to report "Schema current: 35 tables" — a table COUNT,
+ * which cannot distinguish "the column migration applied" from "nothing
+ * happened". 0019_backup_pid adds a column; a rollout runbook asserting
+ * "applied 19 → 20, backups.pid present" had no product surface to check it
+ * against and had to reach for `sqlite3` over SSH.
+ *
+ * This names migrations. Drizzle's `__drizzle_migrations.created_at` is the
+ * journal entry's `when`, so the join back to a human tag is exact.
+ */
+
+import type { Database } from 'bun:sqlite';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findSchemaDrift } from './schema-introspection';
+
+export interface MigrationStatus {
+  /** Rows in `__drizzle_migrations` — what the runbook calls "applied count". */
+  appliedCount: number;
+  /** Tag of the newest applied migration, e.g. `0019_backup_pid`. */
+  latestApplied: string | null;
+  /** Tags present on disk that this DB has not applied, oldest first. */
+  pending: string[];
+  /** Tables the running code declares that the DB lacks. */
+  missingTables: string[];
+  /** `table.column` the running code declares that the DB lacks. */
+  missingColumns: string[];
+  tableCount: number;
+  columnCount: number;
+}
+
+interface JournalEntry {
+  when: number;
+  tag: string;
+}
+
+/** Journal entries (oldest first), or [] when the folder has no journal. */
+export function readMigrationJournal(migrationsFolder: string): JournalEntry[] {
+  const path = join(migrationsFolder, 'meta', '_journal.json');
+  if (!existsSync(path)) return [];
+  const parsed = JSON.parse(readFileSync(path, 'utf-8')) as { entries?: JournalEntry[] };
+  return [...(parsed.entries ?? [])].sort((a, b) => a.when - b.when);
+}
+
+/** `created_at` timestamps recorded in `__drizzle_migrations` (empty if untracked). */
+function appliedTimestamps(sqlite: Database): number[] {
+  try {
+    return sqlite
+      .query<{ created_at: number }, []>(
+        'SELECT created_at FROM `__drizzle_migrations` ORDER BY created_at',
+      )
+      .all()
+      .map((r) => r.created_at);
+  } catch {
+    // No migrations table — a DB that has never been through the migrator.
+    return [];
+  }
+}
+
+export function getMigrationStatus(sqlite: Database, migrationsFolder: string): MigrationStatus {
+  const journal = readMigrationJournal(migrationsFolder);
+  const applied = new Set(appliedTimestamps(sqlite));
+  const appliedTags = journal.filter((e) => applied.has(e.when)).map((e) => e.tag);
+  const pending = journal.filter((e) => !applied.has(e.when)).map((e) => e.tag);
+  const drift = findSchemaDrift(sqlite);
+
+  return {
+    appliedCount: applied.size,
+    latestApplied: appliedTags.at(-1) ?? null,
+    pending,
+    missingTables: drift.missingTables,
+    missingColumns: drift.missingColumns,
+    tableCount: drift.tableCount,
+    columnCount: drift.columnCount,
+  };
+}

package/src/db/schema-introspection.ts

@@ -20,6 +20,12 @@ export interface SchemaDrift {
   missingColumns: string[];
   /** Total number of tables the code's schema declares. */
   tableCount: number;
+  /**
+   * Total number of columns the code's schema declares. Reported alongside
+   * tableCount so the doctor can say what it actually checked — a table count
+   * alone reads as "columns unverified" even when they were (celilo#604).
+   */
+  columnCount: number;
 }
 
 /** Every table name + column names the drizzle schema declares. */
@@ -84,5 +90,6 @@ export function findSchemaDrift(sqlite: Database): SchemaDrift {
       if (!cols.has(c)) missingColumns.push(`${t.name}.${c}`);
     }
   }
-  return { missingTables, missingColumns, tableCount: tables.length };
+  const columnCount = tables.reduce((n, t) => n + t.columns.length, 0);
+  return { missingTables, missingColumns, tableCount: tables.length, columnCount };
 }

package/src/services/backup-metadata.ts

@@ -156,6 +156,23 @@ export function listBackups(options?: {
   return db.select().from(backups).orderBy(desc(backups.startedAt)).limit(limit).all();
 }
 
+/**
+ * Every backup record still claiming to be in progress, oldest first.
+ *
+ * Feeds the record-resolution pass (`resolveAbandonedBackups`), which corrects
+ * the ones whose process is gone. Unbounded on purpose — there is no sensible
+ * limit on "how many lies to fix", and celilo-mgr had 107 of them.
+ */
+export function listInProgressBackups(): Backup[] {
+  const db = getDb();
+  return db
+    .select()
+    .from(backups)
+    .where(eq(backups.status, 'in_progress'))
+    .orderBy(backups.startedAt)
+    .all();
+}
+
 /**
  * List completed backups for a specific module, ordered newest first
  */

package/src/services/backup-staging.test.ts

@@ -1,10 +1,14 @@
 import { describe, expect, test } from 'bun:test';
 import {
+  ABANDONED_BACKUP_MESSAGE,
+  type InProgressBackup,
   type ReapStagingDeps,
+  type ResolveAbandonedDeps,
   STAGING_PREFIX,
   STAGING_TTL_MS,
   type StagingOwner,
   reapOrphanedStaging,
+  resolveAbandonedBackups,
   stagingDirFor,
 } from './backup-staging';
 
@@ -132,3 +136,97 @@ describe('reapOrphanedStaging', () => {
     expect(report.kept).toEqual([locked]);
   });
 });
+
+function recordDeps(
+  records: InProgressBackup[],
+  runnablePids: number[] = [],
+): ResolveAbandonedDeps & { failed: Array<{ id: string; message: string }> } {
+  const failed: Array<{ id: string; message: string }> = [];
+  return {
+    failed,
+    listInProgress: () => records,
+    isPidRunnable: (pid) => runnablePids.includes(pid),
+    fail: (id, message) => failed.push({ id, message }),
+    now: () => NOW,
+  };
+}
+
+function record(over: Partial<InProgressBackup> = {}): InProgressBackup {
+  return { id: 'rec-1', pid: 222, startedAt: new Date(NOW - 60_000), ...over };
+}
+
+describe('resolveAbandonedBackups', () => {
+  // THE REGRESSION THIS EXISTS FOR (#616). Every earlier test supplied a
+  // staging directory, so the coupled implementation passed all of them while
+  // leaving 107 real records stranded. Nothing here mentions staging at all —
+  // that is the point.
+  test('resolves a dead record even though no staging directory exists', () => {
+    const d = recordDeps([record({ id: 'orphan', pid: 999 })], []);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual(['orphan']);
+    expect(d.failed).toEqual([{ id: 'orphan', message: ABANDONED_BACKUP_MESSAGE }]);
+  });
+
+  // All 107 rows on celilo-mgr predate the pid column. Age is the only signal
+  // they carry, so they must resolve on it rather than linger forever.
+  test('resolves a pid-less record once it is past the TTL', () => {
+    const d = recordDeps([
+      record({ id: 'pre-migration', pid: null, startedAt: new Date(NOW - STAGING_TTL_MS - 1) }),
+    ]);
+
+    expect(resolveAbandonedBackups(d).resolved).toEqual(['pre-migration']);
+  });
+
+  test('keeps a pid-less record that is still inside the TTL', () => {
+    const d = recordDeps([record({ id: 'recent', pid: null })]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual([]);
+    expect(report.kept).toEqual(['recent']);
+    expect(d.failed).toEqual([]);
+  });
+
+  // Must never regress: a backup mid-flight is not abandoned.
+  test('KEEPS a record whose process is alive', () => {
+    const d = recordDeps([record({ id: 'live', pid: 222 })], [222]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual([]);
+    expect(report.kept).toEqual(['live']);
+    expect(d.failed).toEqual([]);
+  });
+
+  test('resolves a record past the TTL even when its pid looks alive', () => {
+    // Same pid-reuse guard the reaper applies.
+    const d = recordDeps(
+      [record({ id: 'stale', pid: 222, startedAt: new Date(NOW - STAGING_TTL_MS - 1) })],
+      [222],
+    );
+
+    expect(resolveAbandonedBackups(d).resolved).toEqual(['stale']);
+  });
+
+  test('sorts a mixed set without touching the live one', () => {
+    const d = recordDeps(
+      [
+        record({ id: 'dead', pid: 999 }),
+        record({ id: 'live', pid: 222 }),
+        record({ id: 'old', pid: null, startedAt: new Date(NOW - STAGING_TTL_MS - 1) }),
+      ],
+      [222],
+    );
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved.sort()).toEqual(['dead', 'old']);
+    expect(report.kept).toEqual(['live']);
+  });
+
+  test('nothing in progress is a no-op', () => {
+    const d = recordDeps([]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report).toEqual({ resolved: [], kept: [] });
+    expect(d.failed).toEqual([]);
+  });
+});

package/src/services/backup-staging.ts

@@ -1,5 +1,10 @@
 /**
- * Reclaiming backup staging directories whose owner is gone.
+ * Cleaning up after backups whose process died — the staging they left on disk,
+ * and the records that still claim they are running.
+ *
+ * The two are separate obligations that share a predicate, NOT one obligation
+ * with two effects. Coupling them is exactly the bug in #616; see
+ * `resolveAbandonedBackups`.
  *
  * `backup-create.ts` assembles every envelope in a temp directory and removes
  * it in a `finally`. That is correct and it is not enough: a `finally` does not
@@ -114,6 +119,73 @@ export interface ReapStagingReport {
   ignored: string[];
 }
 
+/** An `in_progress` backup record, as seen by the record-resolution pass. */
+export interface InProgressBackup {
+  id: string;
+  /** Null for records written before backups recorded their pid. */
+  pid: number | null;
+  startedAt: Date;
+}
+
+export interface ResolveAbandonedDeps {
+  listInProgress(): InProgressBackup[];
+  isPidRunnable(pid: number): boolean;
+  fail(recordId: string, message: string): void;
+  now(): number;
+}
+
+export interface ResolveAbandonedReport {
+  /** Records corrected from `in_progress` to failed. */
+  resolved: string[];
+  /** Left alone — a live backup owns them. */
+  kept: string[];
+}
+
+/**
+ * Correct records that still claim to be running after their process died.
+ *
+ * Deliberately INDEPENDENT of staging. The first version of this resolved
+ * records only as a side effect of reclaiming their staging directory, which
+ * was efficient — one liveness lookup serving two places — and strictly
+ * narrower than the requirement. A record whose staging is already gone was
+ * never visited, so it stayed `in_progress` forever: 107 such rows on
+ * celilo-mgr, the oldest from June, none of them reachable by the reaper
+ * because their directories had been cleared by hand (#616).
+ *
+ * That is not an edge case. `/tmp` is declared `D` in tmpfiles.d — cleared on
+ * boot — so ANY backup killed before a reboot loses its staging and becomes
+ * permanently unresolvable under the coupled design. Reclaiming disk and
+ * correcting records are two obligations that happen to share a predicate, not
+ * one obligation with two effects.
+ *
+ * The predicate itself is shared rather than reimplemented: this calls the same
+ * `reclaimReason` the reaper uses, so the TTL-versus-pid-reuse reasoning has
+ * exactly one home. A record is only ever resolved when its owner is provably
+ * gone; a live backup is left alone.
+ */
+export function resolveAbandonedBackups(deps: ResolveAbandonedDeps): ResolveAbandonedReport {
+  const report: ResolveAbandonedReport = { resolved: [], kept: [] };
+
+  for (const record of deps.listInProgress()) {
+    const reason = reclaimReason(
+      { status: 'in_progress', pid: record.pid, startedAt: record.startedAt },
+      deps,
+    );
+
+    // `record-absent` and `record-terminal` are unreachable here — every row
+    // came from a query for in-progress records — so any reason at all means
+    // the owner is gone.
+    if (reason) {
+      deps.fail(record.id, ABANDONED_BACKUP_MESSAGE);
+      report.resolved.push(record.id);
+    } else {
+      report.kept.push(record.id);
+    }
+  }
+
+  return report;
+}
+
 /**
  * Decide, for one staging directory, whether its owner is gone.
  *

package/src/services/backup-sweep.test.ts

@@ -36,6 +36,7 @@ function deps(
       pruned.push(id);
     },
     reapStaging: () => ({ reclaimed: [], kept: [], ignored: [] }),
+    resolveAbandonedRecords: () => ({ resolved: [], kept: [] }),
     ...overrides,
   };
 }
@@ -67,6 +68,20 @@ describe('runBackupSweep', () => {
     expect(report.staging.reclaimed).toHaveLength(1);
   });
 
+  // The sweep must resolve records whether or not the reaper found anything —
+  // that independence IS the fix for #616.
+  test('corrects abandoned records even when no staging was reclaimed', async () => {
+    const report = await runBackupSweep(
+      deps([moduleWith('forgejo', 'daily')], {
+        reapStaging: () => ({ reclaimed: [], kept: [], ignored: [] }),
+        resolveAbandonedRecords: () => ({ resolved: ['rec-a', 'rec-b'], kept: [] }),
+      }),
+    );
+
+    expect(report.staging.reclaimed).toEqual([]);
+    expect(report.records.resolved).toEqual(['rec-a', 'rec-b']);
+  });
+
   test('reclaims staging even when no module is due to back up', async () => {
     const report = await runBackupSweep(
       deps([moduleWith('forgejo', 'daily')], {

package/src/services/backup-sweep.ts

@@ -18,7 +18,7 @@
 
 import type { ModuleManifest } from '../manifest/schema';
 import { type BackupSchedule, effectiveBackupSchedule } from './backup-schedule';
-import type { ReapStagingReport } from './backup-staging';
+import type { ReapStagingReport, ResolveAbandonedReport } from './backup-staging';
 import { InFlightError } from './module-operations';
 
 export const BACKUP_SWEEP_SUBSCRIBER = 'celilo-backup-sweep';
@@ -110,11 +110,21 @@ export interface BackupSweepDeps {
   prune(module: BackupSweepModule): Promise<void>;
   /** Reclaim staging left by backups whose process died. See backup-staging.ts. */
   reapStaging(): ReapStagingReport;
+  /**
+   * Correct records that still claim to be running after their process died.
+   *
+   * Separate from `reapStaging` on purpose. Deriving this from what the reaper
+   * happened to reclaim left records stranded forever once their staging was
+   * gone — #616.
+   */
+  resolveAbandonedRecords(): ResolveAbandonedReport;
 }
 
 export interface BackupSweepReport {
   /** Staging reclaimed before this pass created any of its own. */
   staging: ReapStagingReport;
+  /** Records corrected from a stale `in_progress`. */
+  records: ResolveAbandonedReport;
   backedUp: string[];
   /** Explicit `schedule: manual` — the author opted out. */
   skippedManual: string[];
@@ -131,8 +141,14 @@ export async function runBackupSweep(deps: BackupSweepDeps): Promise<BackupSweep
   // another ~4 GB of it, not once we are finished with it.
   const staging = deps.reapStaging();
 
+  // Independent of the reap above, and that independence is the fix for #616:
+  // a record whose staging is already gone is invisible to the reaper, so
+  // resolving records off the reaper's results left 107 of them stranded.
+  const records = deps.resolveAbandonedRecords();
+
   const report: BackupSweepReport = {
     staging,
+    records,
     backedUp: [],
     skippedManual: [],
     skippedNotDue: [],

package/src/services/bus-interview-park.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Does `busInterview` actually PARK?
+ *
+ * celilo#609's whole scope rests on one claim: a command blocked on an
+ * unanswered interview stays alive indefinitely and resumes when the question
+ * is answered later. If true, #609 needs no command-state serialization — only
+ * session lifetime and re-attach. If the command instead dies quietly, #609 is
+ * a much larger design.
+ *
+ * That claim was originally read off the code (`timeoutMs: 0`), which is not
+ * the same as watching it happen. This file watches it happen: a real
+ * `module update` sweep parks on a breaking-update confirm nobody answers,
+ * stays parked, and then resumes and uses the answer when one arrives by event
+ * id — the same reply `celilo events reply <id> <value>` emits.
+ *
+ * The responder here answers `responder.probe` but deliberately ignores the
+ * interview, which is exactly the #609 situation: a responder exists (the
+ * api-serve bridge), so the fail-fast guard passes, but nobody can decide.
+ */
+
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type Bus, type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
+import { handleModuleUpdate } from '../cli/commands/module-update';
+import { getDb } from '../db/client';
+import { modules } from '../db/schema';
+import { RESPONDER_PROBE_EVENT } from './responder-probe';
+
+const NO_SCHEMAS = defineEvents({});
+const QUERY_TYPE = 'interview.required.module-upgrade:iptables.apply_breaking';
+
+let dir: string;
+let server: ReturnType<typeof Bun.serve>;
+let registryUrl: string;
+
+/** A responder that proves liveness but never answers the question. */
+function probeOnlyResponder(busDbPath: string): { bus: Bus; close: () => void } {
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  const watch = bus.watch(RESPONDER_PROBE_EVENT, async (event) => {
+    if (event.replyFor !== null) return;
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { kind: 'daemon', emittedBy: 'park-test' },
+      { replyFor: event.id, emittedBy: 'park-test' },
+    );
+  });
+  return {
+    bus,
+    close: () => {
+      watch.close();
+      bus.close();
+    },
+  };
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'celilo-park-'));
+  process.env.CELILO_DB_PATH = join(dir, 'test.db');
+  process.env.CELILO_ORIGINAL_CWD = dir;
+  process.env.EVENT_BUS_DB = join(dir, 'events.db');
+
+  getDb()
+    .insert(modules)
+    .values({
+      id: 'iptables',
+      name: 'iptables',
+      sourcePath: join(dir, 'installed'),
+      version: '1.0.2+9',
+      manifestData: { celilo_contract: '1.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
+    })
+    .run();
+
+  server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      if (new URL(req.url).pathname === '/index/ip/ta/iptables') {
+        return new Response(
+          `${JSON.stringify({ name: 'iptables', vers: '2.0.0+1', deps: [], cksum: 'x' })}\n`,
+        );
+      }
+      return new Response('not found', { status: 404 });
+    },
+  });
+  registryUrl = `http://localhost:${server.port}`;
+});
+
+afterEach(() => {
+  server.stop(true);
+  rmSync(dir, { recursive: true, force: true });
+  process.env.CELILO_DB_PATH = undefined;
+  process.env.CELILO_ORIGINAL_CWD = undefined;
+  process.env.EVENT_BUS_DB = undefined;
+});
+
+test('a command parks on an unanswered interview, then resumes with an answer given later', async () => {
+  const responder = probeOnlyResponder(join(dir, 'events.db'));
+  const observer = openBus({ dbPath: join(dir, 'events.db'), events: NO_SCHEMAS });
+
+  try {
+    // Start the sweep but do NOT await it — it should block on the confirm.
+    let settled = false;
+    const sweep = handleModuleUpdate([], { registry: registryUrl }).then((r) => {
+      settled = true;
+      return r;
+    });
+
+    // 1. It parks. The sweep resolves in milliseconds if it does NOT park, so
+    //    any interval well past the 250ms bus poll proves the point — no reason
+    //    to hold a CI runner for seconds to say it.
+    await sleep(600);
+    expect(settled).toBe(false);
+
+    // 2. The question is on the bus, unanswered, and identifiable by event id.
+    const queries = observer.recentEvents({ type: QUERY_TYPE });
+    expect(queries.length).toBe(1);
+    const query = queries[0] as BusEvent;
+    const replies = observer.recentEvents({ type: `${QUERY_TYPE}.reply` });
+    expect(replies.length).toBe(0);
+
+    // 3. Answer it out-of-band, exactly as `celilo events reply <id> false` does.
+    observer.emitRaw(
+      `${QUERY_TYPE}.reply`,
+      { value: false },
+      { replyFor: query.id, emittedBy: 'claude-config-responder' },
+    );
+
+    // 4. It resumes AND uses the answer: `false` is a genuine decline, so the
+    //    summary must say declined — not "NOT declined", which is what we'd see
+    //    if it had failed rather than parked.
+    const result = await sweep;
+    const report = result.success ? (result.message ?? '') : (result.error ?? '');
+    expect(report).toContain('operator declined');
+    expect(report).not.toContain('NOT declined');
+    expect(result.success).toBe(true);
+  } finally {
+    observer.close();
+    responder.close();
+  }
+}, 30_000);
+
+/**
+ * The instrument the original report reached for cannot see this question.
+ *
+ * `celilo events list-pending` is `bus.pendingDeliveries()` — it reads the
+ * `deliveries` table (subscriber fan-out), while an unanswered interview is a
+ * row in `events` awaiting a correlated reply. So "list-pending returned []"
+ * was never evidence about the interview either way. This pins that down so
+ * #609 builds its observability gate on something that can actually observe.
+ */
+test('events list-pending cannot see a parked interview — it reads a different table', async () => {
+  const responder = probeOnlyResponder(join(dir, 'events.db'));
+  const observer = openBus({ dbPath: join(dir, 'events.db'), events: NO_SCHEMAS });
+
+  try {
+    const sweep = handleModuleUpdate([], { registry: registryUrl });
+    await sleep(600);
+
+    // The question is genuinely there...
+    const queries = observer.recentEvents({ type: QUERY_TYPE });
+    expect(queries.length).toBe(1);
+
+    // ...and list-pending shows nothing, because it is looking elsewhere.
+    expect(observer.pendingDeliveries({ limit: 100 })).toHaveLength(0);
+
+    observer.emitRaw(
+      `${QUERY_TYPE}.reply`,
+      { value: false },
+      { replyFor: queries[0].id, emittedBy: 'park-test' },
+    );
+    await sweep;
+  } finally {
+    observer.close();
+    responder.close();
+  }
+}, 30_000);