@celilo/cli 0.19.0 → 0.20.0

package/src/services/backup-staging.test.ts

@@ -1,10 +1,14 @@
 import { describe, expect, test } from 'bun:test';
 import {
+  ABANDONED_BACKUP_MESSAGE,
+  type InProgressBackup,
   type ReapStagingDeps,
+  type ResolveAbandonedDeps,
   STAGING_PREFIX,
   STAGING_TTL_MS,
   type StagingOwner,
   reapOrphanedStaging,
+  resolveAbandonedBackups,
   stagingDirFor,
 } from './backup-staging';
 
@@ -132,3 +136,97 @@ describe('reapOrphanedStaging', () => {
     expect(report.kept).toEqual([locked]);
   });
 });
+
+function recordDeps(
+  records: InProgressBackup[],
+  runnablePids: number[] = [],
+): ResolveAbandonedDeps & { failed: Array<{ id: string; message: string }> } {
+  const failed: Array<{ id: string; message: string }> = [];
+  return {
+    failed,
+    listInProgress: () => records,
+    isPidRunnable: (pid) => runnablePids.includes(pid),
+    fail: (id, message) => failed.push({ id, message }),
+    now: () => NOW,
+  };
+}
+
+function record(over: Partial<InProgressBackup> = {}): InProgressBackup {
+  return { id: 'rec-1', pid: 222, startedAt: new Date(NOW - 60_000), ...over };
+}
+
+describe('resolveAbandonedBackups', () => {
+  // THE REGRESSION THIS EXISTS FOR (#616). Every earlier test supplied a
+  // staging directory, so the coupled implementation passed all of them while
+  // leaving 107 real records stranded. Nothing here mentions staging at all —
+  // that is the point.
+  test('resolves a dead record even though no staging directory exists', () => {
+    const d = recordDeps([record({ id: 'orphan', pid: 999 })], []);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual(['orphan']);
+    expect(d.failed).toEqual([{ id: 'orphan', message: ABANDONED_BACKUP_MESSAGE }]);
+  });
+
+  // All 107 rows on celilo-mgr predate the pid column. Age is the only signal
+  // they carry, so they must resolve on it rather than linger forever.
+  test('resolves a pid-less record once it is past the TTL', () => {
+    const d = recordDeps([
+      record({ id: 'pre-migration', pid: null, startedAt: new Date(NOW - STAGING_TTL_MS - 1) }),
+    ]);
+
+    expect(resolveAbandonedBackups(d).resolved).toEqual(['pre-migration']);
+  });
+
+  test('keeps a pid-less record that is still inside the TTL', () => {
+    const d = recordDeps([record({ id: 'recent', pid: null })]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual([]);
+    expect(report.kept).toEqual(['recent']);
+    expect(d.failed).toEqual([]);
+  });
+
+  // Must never regress: a backup mid-flight is not abandoned.
+  test('KEEPS a record whose process is alive', () => {
+    const d = recordDeps([record({ id: 'live', pid: 222 })], [222]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved).toEqual([]);
+    expect(report.kept).toEqual(['live']);
+    expect(d.failed).toEqual([]);
+  });
+
+  test('resolves a record past the TTL even when its pid looks alive', () => {
+    // Same pid-reuse guard the reaper applies.
+    const d = recordDeps(
+      [record({ id: 'stale', pid: 222, startedAt: new Date(NOW - STAGING_TTL_MS - 1) })],
+      [222],
+    );
+
+    expect(resolveAbandonedBackups(d).resolved).toEqual(['stale']);
+  });
+
+  test('sorts a mixed set without touching the live one', () => {
+    const d = recordDeps(
+      [
+        record({ id: 'dead', pid: 999 }),
+        record({ id: 'live', pid: 222 }),
+        record({ id: 'old', pid: null, startedAt: new Date(NOW - STAGING_TTL_MS - 1) }),
+      ],
+      [222],
+    );
+    const report = resolveAbandonedBackups(d);
+
+    expect(report.resolved.sort()).toEqual(['dead', 'old']);
+    expect(report.kept).toEqual(['live']);
+  });
+
+  test('nothing in progress is a no-op', () => {
+    const d = recordDeps([]);
+    const report = resolveAbandonedBackups(d);
+
+    expect(report).toEqual({ resolved: [], kept: [] });
+    expect(d.failed).toEqual([]);
+  });
+});

package/src/services/backup-staging.ts

@@ -1,5 +1,10 @@
 /**
- * Reclaiming backup staging directories whose owner is gone.
+ * Cleaning up after backups whose process died — the staging they left on disk,
+ * and the records that still claim they are running.
+ *
+ * The two are separate obligations that share a predicate, NOT one obligation
+ * with two effects. Coupling them is exactly the bug in #616; see
+ * `resolveAbandonedBackups`.
  *
  * `backup-create.ts` assembles every envelope in a temp directory and removes
  * it in a `finally`. That is correct and it is not enough: a `finally` does not
@@ -114,6 +119,73 @@ export interface ReapStagingReport {
   ignored: string[];
 }
 
+/** An `in_progress` backup record, as seen by the record-resolution pass. */
+export interface InProgressBackup {
+  id: string;
+  /** Null for records written before backups recorded their pid. */
+  pid: number | null;
+  startedAt: Date;
+}
+
+export interface ResolveAbandonedDeps {
+  listInProgress(): InProgressBackup[];
+  isPidRunnable(pid: number): boolean;
+  fail(recordId: string, message: string): void;
+  now(): number;
+}
+
+export interface ResolveAbandonedReport {
+  /** Records corrected from `in_progress` to failed. */
+  resolved: string[];
+  /** Left alone — a live backup owns them. */
+  kept: string[];
+}
+
+/**
+ * Correct records that still claim to be running after their process died.
+ *
+ * Deliberately INDEPENDENT of staging. The first version of this resolved
+ * records only as a side effect of reclaiming their staging directory, which
+ * was efficient — one liveness lookup serving two places — and strictly
+ * narrower than the requirement. A record whose staging is already gone was
+ * never visited, so it stayed `in_progress` forever: 107 such rows on
+ * celilo-mgr, the oldest from June, none of them reachable by the reaper
+ * because their directories had been cleared by hand (#616).
+ *
+ * That is not an edge case. `/tmp` is declared `D` in tmpfiles.d — cleared on
+ * boot — so ANY backup killed before a reboot loses its staging and becomes
+ * permanently unresolvable under the coupled design. Reclaiming disk and
+ * correcting records are two obligations that happen to share a predicate, not
+ * one obligation with two effects.
+ *
+ * The predicate itself is shared rather than reimplemented: this calls the same
+ * `reclaimReason` the reaper uses, so the TTL-versus-pid-reuse reasoning has
+ * exactly one home. A record is only ever resolved when its owner is provably
+ * gone; a live backup is left alone.
+ */
+export function resolveAbandonedBackups(deps: ResolveAbandonedDeps): ResolveAbandonedReport {
+  const report: ResolveAbandonedReport = { resolved: [], kept: [] };
+
+  for (const record of deps.listInProgress()) {
+    const reason = reclaimReason(
+      { status: 'in_progress', pid: record.pid, startedAt: record.startedAt },
+      deps,
+    );
+
+    // `record-absent` and `record-terminal` are unreachable here — every row
+    // came from a query for in-progress records — so any reason at all means
+    // the owner is gone.
+    if (reason) {
+      deps.fail(record.id, ABANDONED_BACKUP_MESSAGE);
+      report.resolved.push(record.id);
+    } else {
+      report.kept.push(record.id);
+    }
+  }
+
+  return report;
+}
+
 /**
  * Decide, for one staging directory, whether its owner is gone.
  *

package/src/services/backup-sweep.test.ts

@@ -36,6 +36,7 @@ function deps(
       pruned.push(id);
     },
     reapStaging: () => ({ reclaimed: [], kept: [], ignored: [] }),
+    resolveAbandonedRecords: () => ({ resolved: [], kept: [] }),
     ...overrides,
   };
 }
@@ -67,6 +68,20 @@ describe('runBackupSweep', () => {
     expect(report.staging.reclaimed).toHaveLength(1);
   });
 
+  // The sweep must resolve records whether or not the reaper found anything —
+  // that independence IS the fix for #616.
+  test('corrects abandoned records even when no staging was reclaimed', async () => {
+    const report = await runBackupSweep(
+      deps([moduleWith('forgejo', 'daily')], {
+        reapStaging: () => ({ reclaimed: [], kept: [], ignored: [] }),
+        resolveAbandonedRecords: () => ({ resolved: ['rec-a', 'rec-b'], kept: [] }),
+      }),
+    );
+
+    expect(report.staging.reclaimed).toEqual([]);
+    expect(report.records.resolved).toEqual(['rec-a', 'rec-b']);
+  });
+
   test('reclaims staging even when no module is due to back up', async () => {
     const report = await runBackupSweep(
       deps([moduleWith('forgejo', 'daily')], {

package/src/services/backup-sweep.ts

@@ -18,7 +18,7 @@
 
 import type { ModuleManifest } from '../manifest/schema';
 import { type BackupSchedule, effectiveBackupSchedule } from './backup-schedule';
-import type { ReapStagingReport } from './backup-staging';
+import type { ReapStagingReport, ResolveAbandonedReport } from './backup-staging';
 import { InFlightError } from './module-operations';
 
 export const BACKUP_SWEEP_SUBSCRIBER = 'celilo-backup-sweep';
@@ -110,11 +110,21 @@ export interface BackupSweepDeps {
   prune(module: BackupSweepModule): Promise<void>;
   /** Reclaim staging left by backups whose process died. See backup-staging.ts. */
   reapStaging(): ReapStagingReport;
+  /**
+   * Correct records that still claim to be running after their process died.
+   *
+   * Separate from `reapStaging` on purpose. Deriving this from what the reaper
+   * happened to reclaim left records stranded forever once their staging was
+   * gone — #616.
+   */
+  resolveAbandonedRecords(): ResolveAbandonedReport;
 }
 
 export interface BackupSweepReport {
   /** Staging reclaimed before this pass created any of its own. */
   staging: ReapStagingReport;
+  /** Records corrected from a stale `in_progress`. */
+  records: ResolveAbandonedReport;
   backedUp: string[];
   /** Explicit `schedule: manual` — the author opted out. */
   skippedManual: string[];
@@ -131,8 +141,14 @@ export async function runBackupSweep(deps: BackupSweepDeps): Promise<BackupSweep
   // another ~4 GB of it, not once we are finished with it.
   const staging = deps.reapStaging();
 
+  // Independent of the reap above, and that independence is the fix for #616:
+  // a record whose staging is already gone is invisible to the reaper, so
+  // resolving records off the reaper's results left 107 of them stranded.
+  const records = deps.resolveAbandonedRecords();
+
   const report: BackupSweepReport = {
     staging,
+    records,
     backedUp: [],
     skippedManual: [],
     skippedNotDue: [],

package/src/services/bus-interview-park.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Does `busInterview` actually PARK?
+ *
+ * celilo#609's whole scope rests on one claim: a command blocked on an
+ * unanswered interview stays alive indefinitely and resumes when the question
+ * is answered later. If true, #609 needs no command-state serialization — only
+ * session lifetime and re-attach. If the command instead dies quietly, #609 is
+ * a much larger design.
+ *
+ * That claim was originally read off the code (`timeoutMs: 0`), which is not
+ * the same as watching it happen. This file watches it happen: a real
+ * `module update` sweep parks on a breaking-update confirm nobody answers,
+ * stays parked, and then resumes and uses the answer when one arrives by event
+ * id — the same reply `celilo events reply <id> <value>` emits.
+ *
+ * The responder here answers `responder.probe` but deliberately ignores the
+ * interview, which is exactly the #609 situation: a responder exists (the
+ * api-serve bridge), so the fail-fast guard passes, but nobody can decide.
+ */
+
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type Bus, type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
+import { handleModuleUpdate } from '../cli/commands/module-update';
+import { getDb } from '../db/client';
+import { modules } from '../db/schema';
+import { RESPONDER_PROBE_EVENT } from './responder-probe';
+
+const NO_SCHEMAS = defineEvents({});
+const QUERY_TYPE = 'interview.required.module-upgrade:iptables.apply_breaking';
+
+let dir: string;
+let server: ReturnType<typeof Bun.serve>;
+let registryUrl: string;
+
+/** A responder that proves liveness but never answers the question. */
+function probeOnlyResponder(busDbPath: string): { bus: Bus; close: () => void } {
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  const watch = bus.watch(RESPONDER_PROBE_EVENT, async (event) => {
+    if (event.replyFor !== null) return;
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { kind: 'daemon', emittedBy: 'park-test' },
+      { replyFor: event.id, emittedBy: 'park-test' },
+    );
+  });
+  return {
+    bus,
+    close: () => {
+      watch.close();
+      bus.close();
+    },
+  };
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'celilo-park-'));
+  process.env.CELILO_DB_PATH = join(dir, 'test.db');
+  process.env.CELILO_ORIGINAL_CWD = dir;
+  process.env.EVENT_BUS_DB = join(dir, 'events.db');
+
+  getDb()
+    .insert(modules)
+    .values({
+      id: 'iptables',
+      name: 'iptables',
+      sourcePath: join(dir, 'installed'),
+      version: '1.0.2+9',
+      manifestData: { celilo_contract: '1.0', id: 'iptables', name: 'iptables', version: '1.0.2' },
+    })
+    .run();
+
+  server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      if (new URL(req.url).pathname === '/index/ip/ta/iptables') {
+        return new Response(
+          `${JSON.stringify({ name: 'iptables', vers: '2.0.0+1', deps: [], cksum: 'x' })}\n`,
+        );
+      }
+      return new Response('not found', { status: 404 });
+    },
+  });
+  registryUrl = `http://localhost:${server.port}`;
+});
+
+afterEach(() => {
+  server.stop(true);
+  rmSync(dir, { recursive: true, force: true });
+  process.env.CELILO_DB_PATH = undefined;
+  process.env.CELILO_ORIGINAL_CWD = undefined;
+  process.env.EVENT_BUS_DB = undefined;
+});
+
+test('a command parks on an unanswered interview, then resumes with an answer given later', async () => {
+  const responder = probeOnlyResponder(join(dir, 'events.db'));
+  const observer = openBus({ dbPath: join(dir, 'events.db'), events: NO_SCHEMAS });
+
+  try {
+    // Start the sweep but do NOT await it — it should block on the confirm.
+    let settled = false;
+    const sweep = handleModuleUpdate([], { registry: registryUrl }).then((r) => {
+      settled = true;
+      return r;
+    });
+
+    // 1. It parks. The sweep resolves in milliseconds if it does NOT park, so
+    //    any interval well past the 250ms bus poll proves the point — no reason
+    //    to hold a CI runner for seconds to say it.
+    await sleep(600);
+    expect(settled).toBe(false);
+
+    // 2. The question is on the bus, unanswered, and identifiable by event id.
+    const queries = observer.recentEvents({ type: QUERY_TYPE });
+    expect(queries.length).toBe(1);
+    const query = queries[0] as BusEvent;
+    const replies = observer.recentEvents({ type: `${QUERY_TYPE}.reply` });
+    expect(replies.length).toBe(0);
+
+    // 3. Answer it out-of-band, exactly as `celilo events reply <id> false` does.
+    observer.emitRaw(
+      `${QUERY_TYPE}.reply`,
+      { value: false },
+      { replyFor: query.id, emittedBy: 'claude-config-responder' },
+    );
+
+    // 4. It resumes AND uses the answer: `false` is a genuine decline, so the
+    //    summary must say declined — not "NOT declined", which is what we'd see
+    //    if it had failed rather than parked.
+    const result = await sweep;
+    const report = result.success ? (result.message ?? '') : (result.error ?? '');
+    expect(report).toContain('operator declined');
+    expect(report).not.toContain('NOT declined');
+    expect(result.success).toBe(true);
+  } finally {
+    observer.close();
+    responder.close();
+  }
+}, 30_000);
+
+/**
+ * The instrument the original report reached for cannot see this question.
+ *
+ * `celilo events list-pending` is `bus.pendingDeliveries()` — it reads the
+ * `deliveries` table (subscriber fan-out), while an unanswered interview is a
+ * row in `events` awaiting a correlated reply. So "list-pending returned []"
+ * was never evidence about the interview either way. This pins that down so
+ * #609 builds its observability gate on something that can actually observe.
+ */
+test('events list-pending cannot see a parked interview — it reads a different table', async () => {
+  const responder = probeOnlyResponder(join(dir, 'events.db'));
+  const observer = openBus({ dbPath: join(dir, 'events.db'), events: NO_SCHEMAS });
+
+  try {
+    const sweep = handleModuleUpdate([], { registry: registryUrl });
+    await sleep(600);
+
+    // The question is genuinely there...
+    const queries = observer.recentEvents({ type: QUERY_TYPE });
+    expect(queries.length).toBe(1);
+
+    // ...and list-pending shows nothing, because it is looking elsewhere.
+    expect(observer.pendingDeliveries({ limit: 100 })).toHaveLength(0);
+
+    observer.emitRaw(
+      `${QUERY_TYPE}.reply`,
+      { value: false },
+      { replyFor: queries[0].id, emittedBy: 'park-test' },
+    );
+    await sweep;
+  } finally {
+    observer.close();
+    responder.close();
+  }
+}, 30_000);

package/src/services/bus-interview.ts

@@ -7,14 +7,16 @@
  *
  * No timeouts: the deploy waits indefinitely for a responder. If
  * nothing answers, the operator sees the unanswered query via
- * `celilo events list-pending` and fixes the responder setup.
+ * `celilo events list-unanswered` and answers it with `celilo events
+ * reply <id> <value>`. (NOT `events list-pending` — that reads the
+ * subscriber `deliveries` table and cannot see an unanswered query.)
  *
  * See `infra/openspec/changes/interactive-deploys-via-event-bus/proposal.md`.
  */
 
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
 import { getEventBusPath } from '../config/paths';
-import { InterviewUnansweredError } from './interview-errors';
+import { InterviewAbandonedError } from './interview-errors';
 import { ensureResponderForInterview } from './responder-probe';
 
 const NO_SCHEMAS = defineEvents({});
@@ -241,12 +243,15 @@ export interface InterviewRequiredPayload {
 export interface InterviewReply {
   value: unknown;
   /**
-   * Set instead of `value` when the responder could not reach a decider (e.g.
-   * the remote client has no TTY and no pre-staged answer). `askInterview`
-   * turns it into an `InterviewUnansweredError` so the question fails loudly
-   * rather than silently resolving to `defaultValue`.
+   * Set instead of `value` when the question was reaped rather than decided —
+   * a parked session passed its TTL with nobody answering. `askInterview` turns
+   * it into an `InterviewAbandonedError`, which is distinct from both a decline
+   * (someone said no) and an unanswered question (still standing).
+   *
+   * A responder that merely *cannot* decide emits nothing at all: the query
+   * stays unanswered and the asking command stays parked (celilo#609).
    */
-  error?: string;
+  abandoned?: { reason: string };
 }
 
 /**
@@ -324,7 +329,7 @@ export async function askInterview(
 ): Promise<unknown> {
   const type = EVENT_TYPES.interviewRequired(payload.scope, payload.key);
   const reply = await busInterviewGuarded<InterviewReply>(type, payload, ownerBus);
-  if (reply.error) throw new InterviewUnansweredError(type, reply.error);
+  if (reply.abandoned) throw new InterviewAbandonedError(type, reply.abandoned.reason);
   return reply.value;
 }
 

package/src/services/interview-errors.ts

@@ -1,12 +1,15 @@
 /**
- * The one error type that means "this interview question could not be
- * answered". Its own module so `responder-probe` (no responder listening) and
- * `bus-interview` (a responder replied that it couldn't decide) can both throw
- * it without importing each other.
+ * The two error types that mean "this interview question was not decided".
+ * Their own module so `responder-probe` (nobody is listening at all) and the
+ * session reaper (a parked question expired) can both throw without importing
+ * each other.
  *
- * Callers catch this to distinguish an *unanswered* question from an answered
- * one — the distinction `module update` conflated when it reported a breaking
- * update as "operator declined" that no operator had ever seen.
+ * Callers catch these to distinguish a question that was never decided from one
+ * that was answered — the distinction `module update` conflated when it reported
+ * a breaking update as "operator declined" that no operator had ever seen. The
+ * two are not interchangeable: *unanswered* means no responder could even be
+ * found, *abandoned* means a responder existed, the question stood, and the
+ * deadline passed with nobody deciding.
  */
 export class InterviewUnansweredError extends Error {
   constructor(
@@ -18,3 +21,17 @@ export class InterviewUnansweredError extends Error {
     this.name = 'InterviewUnansweredError';
   }
 }
+
+/**
+ * The question was posted, stood unanswered past its session's TTL, and the
+ * reaper answered it `abandoned` to release what the parked command held.
+ */
+export class InterviewAbandonedError extends Error {
+  constructor(
+    readonly queryType: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = 'InterviewAbandonedError';
+  }
+}

package/src/services/remote-responder.test.ts

@@ -78,12 +78,18 @@ test('answers responder.probe with kind daemon', async () => {
 }, 15_000);
 
 /**
- * When the client can't reach a decider it says so. The responder must relay
- * that as an error reply — the waiting command then fails loudly instead of the
- * question quietly resolving to `defaultValue`, which is how a breaking update
- * came to be recorded as "operator declined".
+ * A responder that cannot reach a decider must emit NOTHING (celilo#609).
+ *
+ * PR #607 had it reply `{error}` here, which reads as "fail loudly" but carries
+ * `replyFor: <query id>` — it *consumes the query*. The question then no longer
+ * exists for anyone else to answer, and the command dies with it. Leaving it
+ * unanswered parks the command instead, so a later responder can still decide.
+ *
+ * Asserted on the value that comes back, not on liveness: the reply emitted
+ * afterwards correlates to the original query, which is only true if the
+ * responder left it standing.
  */
-test('an ask that cannot be answered replies with an error, not the default', async () => {
+test('an ask that cannot be answered emits no reply — the query stays answerable', async () => {
   const responder = startRemoteResponder({
     busDbPath,
     ask: async () => {
@@ -92,24 +98,31 @@ test('an ask that cannot be answered replies with an error, not the default', as
   });
 
   const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  const type = 'interview.required.module-upgrade:iptables.apply_breaking';
   try {
-    const replies = (await bus.query(
-      'interview.required.module-upgrade:iptables.apply_breaking' as never,
-      {
-        scope: 'module-upgrade:iptables',
-        key: 'apply_breaking',
-        kind: 'confirm',
-        message: 'Apply breaking update for iptables?',
-        required: true,
-        defaultValue: 'false',
-      } as never,
-      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
-    )) as BusEvent[];
+    const query = bus.emitRaw(type, {
+      scope: 'module-upgrade:iptables',
+      key: 'apply_breaking',
+      kind: 'confirm',
+      message: 'Apply breaking update for iptables?',
+      required: true,
+      defaultValue: 'false',
+    });
+
+    // Well past the responder's watch latency: still nobody has answered.
+    await new Promise((r) => setTimeout(r, 600));
+    expect(bus.recentEvents({ type: `${type}.reply` })).toHaveLength(0);
 
+    // And the query is still live: a reply emitted now is a genuine answer.
+    bus.emitRaw(
+      `${type}.reply`,
+      { value: false },
+      { replyFor: query.id, emittedBy: 'later-responder' },
+    );
+    const replies = bus.recentEvents({ type: `${type}.reply` });
     expect(replies).toHaveLength(1);
-    const payload = replies[0].payload as { value?: unknown; error?: string };
-    expect(payload.value).toBeUndefined();
-    expect(payload.error).toContain('terminal');
+    expect((replies[0].payload as { value: unknown }).value).toBe(false);
+    expect(replies[0].replyFor).toBe(query.id);
   } finally {
     bus.close();
     responder.close();

package/src/services/remote-responder.ts

@@ -72,12 +72,16 @@ export function startRemoteResponder(opts: RemoteResponderOptions): RemoteRespon
         required: payload.required,
       });
     } catch (err) {
-      // The client had no way to answer. Reply with the reason so the waiting
-      // command fails loudly — never let the question decay to its default.
-      bus.emitRaw(
-        `${event.type}.reply`,
-        { error: err instanceof Error ? err.message : String(err) },
-        { replyFor: event.id, emittedBy: me },
+      // The client had no way to answer — so we emit NOTHING. A reply of any
+      // shape consumes the query (it carries `replyFor: event.id`), destroying
+      // a question nobody has answered yet; the asking command then dies with
+      // it and no other responder can ever act. Leaving it unanswered parks the
+      // command instead, which is what `busInterview`'s `timeoutMs: 0` is for.
+      // The client learns it is parked from the `blocked` wire message.
+      process.stderr.write(
+        `[remote-responder] parked ${event.type} (#${event.id}): ${
+          err instanceof Error ? err.message : String(err)
+        }\n`,
       );
       return;
     }