@celilo/cli 2.3.0 → 3.1.0

package/src/services/capability-compat.ts

@@ -0,0 +1,128 @@
+/**
+ * Capability compatibility between a module's declared requirements and the
+ * providers actually deployed in the fleet.
+ *
+ * The pure half mirrors the runtime lookup's semantics (see
+ * `deploy-preflight.ts` section 2): a requirement is served when ANY deployed
+ * provider satisfies it under `compareConsumerToProvider`. The reason
+ * `deploy-preflight` and the upgrade path must agree is the failure
+ * celilo#1361 recorded: celilo-website was upgraded against a caddy whose
+ * bundled provider rejected its publish calls, and every attempt burned a
+ * release. The upgrade path now asks this question BEFORE updating, and
+ * defers instead of deploying into a wall.
+ */
+
+import { compareConsumerToProvider } from '@celilo/capabilities';
+import type { DbClient } from '../db/client';
+import { capabilities } from '../db/schema';
+import type { ModuleManifest } from '../manifest/schema';
+import { isPrivilegedCapability } from '../manifest/validate';
+
+export interface CapabilityRequirement {
+  name: string;
+  version: string;
+}
+
+export interface DeployedCapabilityProvider {
+  capabilityName: string;
+  moduleId: string;
+  version: string;
+}
+
+export interface UnservedCapability {
+  capability: string;
+  /** The version the module's manifest requires. */
+  required: string;
+  /** Example provider that does not serve it (the first mismatch found). */
+  providerModuleId: string | null;
+  providerVersion: string | null;
+  reason:
+    | 'no_provider'
+    | 'major_mismatch_higher'
+    | 'major_mismatch_lower'
+    | 'minor_mismatch_higher'
+    | 'caller_minor_too_old';
+  message: string;
+}
+
+/**
+ * Which of a module's capability requirements no deployed provider serves.
+ * Pure (Rule 10): the I/O — reading the capabilities table — happens in
+ * `capabilityBlockersForManifest`.
+ */
+export function unservedCapabilityRequirements(
+  requirements: CapabilityRequirement[] | undefined,
+  providers: DeployedCapabilityProvider[],
+): UnservedCapability[] {
+  const unserved: UnservedCapability[] = [];
+  for (const cap of requirements ?? []) {
+    // Framework-granted privileges (e.g. cross_module_read) are not
+    // provider-backed — the same skip `deploy-preflight` makes.
+    if (isPrivilegedCapability(cap.name)) continue;
+
+    const installed = providers.filter((p) => p.capabilityName === cap.name);
+    if (installed.length === 0) {
+      unserved.push({
+        capability: cap.name,
+        required: cap.version,
+        providerModuleId: null,
+        providerVersion: null,
+        reason: 'no_provider',
+        message: `no deployed provider for '${cap.name}'`,
+      });
+      continue;
+    }
+    let anyCompatible = false;
+    let example: DeployedCapabilityProvider | undefined;
+    let reason: UnservedCapability['reason'] = 'major_mismatch_higher';
+    for (const p of installed) {
+      const result = compareConsumerToProvider(cap.version, p.version);
+      if (result.compatible) {
+        anyCompatible = true;
+        break;
+      }
+      if (!example) {
+        example = p;
+        reason = result.reason;
+      }
+    }
+    if (anyCompatible || !example) continue;
+    unserved.push({
+      capability: cap.name,
+      required: cap.version,
+      providerModuleId: example.moduleId,
+      providerVersion: example.version,
+      reason,
+      message: `requires ${cap.name}@${cap.version} but deployed provider '${example.moduleId}' provides ${cap.name}@${example.version} (${reason})`,
+    });
+  }
+  return unserved;
+}
+
+/** Every capability provider currently registered in the fleet. */
+export function readDeployedProviders(db: DbClient): DeployedCapabilityProvider[] {
+  return db
+    .select({
+      capabilityName: capabilities.capabilityName,
+      moduleId: capabilities.moduleId,
+      version: capabilities.version,
+    })
+    .from(capabilities)
+    .all();
+}
+
+/**
+ * The upgrade-path entry point: which of a target manifest's capability
+ * requirements the deployed fleet cannot serve. A non-empty result means the
+ * upgrade would deploy into a wall the preflight would then reject — defer
+ * instead of burning the attempt.
+ */
+export function capabilityBlockersForManifest(
+  db: DbClient,
+  manifest: Pick<ModuleManifest, 'requires' | 'id'>,
+): UnservedCapability[] {
+  return unservedCapabilityRequirements(
+    manifest.requires?.capabilities as CapabilityRequirement[] | undefined,
+    readDeployedProviders(db),
+  );
+}

package/src/services/deploy-terraform.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { log } from '../cli/prompts';
 import { executeBuildWithProgress } from './build-stream';
-import { validateTerraformPlanSafety } from './terraform-safety';
+import { planAfterImportVerdict, validateTerraformPlanSafety } from './terraform-safety';
 
 export interface TerraformResult {
   success: boolean;
@@ -173,6 +173,43 @@ export async function executeTerraform(
 
       if (importResult.success) {
         log.success('Resource imported into Terraform state');
+
+        // The import REPLACED the plan validated above. That plan described a
+        // create; the plan terraform computes now can describe a REPLACE,
+        // because `ostemplate` and `rootfs[0].storage` do not round-trip
+        // through an import and each forces one. Re-plan and re-check, or the
+        // retry applies a destroy the safety gate exists to forbid — which is
+        // how a redeploy destroyed signal's LXC on a converged fleet
+        // (celilo#1374).
+        const rePlan = await executeBuildWithProgress({
+          command: 'terraform',
+          args: ['plan', '-detailed-exitcode', '-no-color'],
+          cwd: terraformDir,
+          title: 'Re-planning after import',
+          env: terraformEnv,
+          noInteractive,
+        });
+
+        const verdict = planAfterImportVerdict(rePlan.exitCode, rePlan.output);
+
+        if (verdict.action === 'done') {
+          // The import alone reconciled state with reality: adopt and stop.
+          if (phases) phases.terraformApply = true;
+          log.success('Infrastructure adopted by import (no changes needed)');
+          return { success: true, output: rePlan.output, exitCode: 0 };
+        }
+
+        if (verdict.action === 'refuse') {
+          if (phases) phases.terraformApply = false;
+          log.error('Refusing to apply the plan computed after import');
+          return {
+            success: false,
+            output: rePlan.output,
+            error: verdict.error,
+            exitCode: 2,
+          };
+        }
+
         log.message('  Retrying deployment...');
 
         // Retry apply after successful import

package/src/services/events-daemon.test.ts

@@ -10,6 +10,7 @@ import {
   readInstalledUnit,
   renderLaunchdPlist,
   renderSystemdUnit,
+  resolveDaemonPathEnv,
   resolveRestartScope,
   resolveRunAsUser,
   restartDaemon,
@@ -27,11 +28,15 @@ describe('renderSystemdUnit', () => {
       concurrency: 4,
       home: '/home/op',
       scope: 'user',
+      pathEnv: '/bun/bin:/usr/bin:/bin',
     });
     expect(out).toContain(
       'ExecStart=/usr/local/bin/celilo events run --poll-ms 1000 --concurrency 4',
     );
     expect(out).toContain('Environment=EVENT_BUS_DB=/var/lib/celilo/events.db');
+    // celilo#1373 — the unit's environment must resolve bun; the global celilo
+    // wrapper is a bash script whose first act is `command -v bun`.
+    expect(out).toContain('Environment=PATH=/bun/bin:/usr/bin:/bin');
     expect(out).toContain('Restart=on-failure');
     expect(out).toContain('WantedBy=default.target');
     expect(out).not.toContain('User=');
@@ -45,6 +50,7 @@ describe('renderSystemdUnit', () => {
       concurrency: 8,
       home: '/h',
       scope: 'user',
+      pathEnv: '/bun/bin:/usr/bin',
     });
     expect(out).toContain('--poll-ms 250 --concurrency 8');
   });
@@ -57,6 +63,7 @@ describe('renderSystemdUnit', () => {
       concurrency: 4,
       home: '/root',
       scope: 'system',
+      pathEnv: '/bun/bin:/usr/bin',
       runAsUser: 'celilo',
     });
     expect(out).toContain('User=celilo');
@@ -75,6 +82,7 @@ describe('renderLaunchdPlist', () => {
       concurrency: 4,
       home: '/Users/op',
       scope: 'user',
+      pathEnv: '/bun/bin:/usr/bin:/bin',
     });
     expect(out).toContain('<string>/Users/op/Library/Logs/celilo-events.out.log</string>');
     expect(out).toContain('<string>/Users/op/Library/Logs/celilo-events.err.log</string>');
@@ -85,6 +93,29 @@ describe('renderLaunchdPlist', () => {
     expect(out).not.toContain('<key>UserName</key>');
   });
 
+  // celilo#1373 — launchd starts jobs with its own default PATH (no bun),
+  // and the global celilo wrapper is a bash script whose first act is
+  // `command -v bun`. The rendered plist MUST carry a PATH that resolves
+  // bun, inside EnvironmentVariables, or the unit crash-loops forever.
+  it('carries a PATH in EnvironmentVariables that resolves bun', () => {
+    const out = renderLaunchdPlist({
+      celiloPath: '/Users/op/.bun/bin/celilo',
+      busDbPath: '/db',
+      pollMs: 1000,
+      concurrency: 4,
+      home: '/Users/op',
+      scope: 'user',
+      pathEnv: '/bun/bin:/usr/local/bin:/usr/bin:/bin',
+    });
+    expect(out).toContain('<key>PATH</key>');
+    expect(out).toContain('<string>/bun/bin:/usr/local/bin:/usr/bin:/bin</string>');
+    // PATH lives INSIDE the EnvironmentVariables dict, after EVENT_BUS_DB.
+    const envIdx = out.indexOf('<key>EnvironmentVariables</key>');
+    const pathIdx = out.indexOf('<key>PATH</key>');
+    expect(envIdx).toBeGreaterThan(-1);
+    expect(pathIdx).toBeGreaterThan(envIdx);
+  });
+
   it('system scope sets UserName and logs under /Library/Logs', () => {
     const out = renderLaunchdPlist({
       celiloPath: '/c',
@@ -93,6 +124,7 @@ describe('renderLaunchdPlist', () => {
       concurrency: 4,
       home: '/Users/op',
       scope: 'system',
+      pathEnv: '/bun/bin:/usr/bin',
       runAsUser: 'celilo',
     });
     expect(out).toContain('<key>UserName</key>');
@@ -103,6 +135,31 @@ describe('renderLaunchdPlist', () => {
   });
 });
 
+describe('resolveDaemonPathEnv', () => {
+  // celilo#1373 — the whole point of the PATH key is that the bun the
+  // wrapper needs is actually in the directory we wrote. First colon
+  // segment, and a bun executable must exist in it.
+  it('starts with a directory that contains a bun executable', () => {
+    const firstDir = resolveDaemonPathEnv().split(':')[0] ?? '';
+    expect(firstDir).not.toBe('');
+    expect(existsSync(join(firstDir, 'bun'))).toBe(true);
+  });
+
+  it('planDaemonInstall pins the PATH into the rendered unit', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'celilo-pathenv-'));
+    const celiloPath = join(dir, 'fake-celilo');
+    writeFileSync(celiloPath, '#!/bin/sh\n', { mode: 0o755 });
+    const plan = planDaemonInstall({
+      platform: 'darwin',
+      scope: 'user',
+      home: join(dir, 'home'),
+      celiloPath,
+      pathEnv: '/bun/bin:/usr/bin:/bin',
+    });
+    expect(plan.unitContent).toContain('<string>/bun/bin:/usr/bin:/bin</string>');
+  });
+});
+
 describe('getDaemonUnitPath', () => {
   it('returns the systemd user path on linux', () => {
     expect(getDaemonUnitPath('linux', '/home/op')).toBe(

package/src/services/events-daemon.ts

@@ -48,6 +48,12 @@ export interface InstallDaemonOptions {
   platform?: SupervisorPlatform;
   /** Override the bus DB path. Defaults to celilo's getEventBusPath(). */
   busDbPath?: string;
+  /**
+   * Override the PATH written into the unit's environment. Defaults to
+   * resolveDaemonPathEnv() captured at render time. Test seam — pin it so
+   * assertions don't depend on the machine's bun install.
+   */
+  pathEnv?: string;
   /** Override the home directory used to compute install paths. */
   home?: string;
   /** Prefix for system-scope paths. Test seam — see getDaemonUnitPath. */
@@ -159,6 +165,47 @@ export function getDaemonUnitPath(
     : join(home, 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
 }
 
+export interface LaunchdUnitStatus {
+  /** The pid launchd currently runs the unit under, or null when it isn't running. */
+  pid: number | null;
+  /**
+   * The unit's last exit status in wait4 form (256 = exited 1, 15 = killed by
+   * SIGTERM), or null when launchd has no record of one.
+   */
+  lastExitStatus: number | null;
+}
+
+/**
+ * Probe launchd for the unit's health. Uses `launchctl list <label>` —
+ * on current macOS the richer `launchctl print gui/<uid>/<label>` answers
+ * "Domain does not support specified action" for legacy-loaded jobs, while
+ * `list <label>` prints a legacy-style dict carrying `PID` (absent when not
+ * running) and `LastExitStatus`.
+ *
+ * Returns null when launchd doesn't answer at all (not loaded, linux, the
+ * binary missing) — null is "don't know", never "bad". Only the user scope
+ * is probed: the system domain needs root, and a mac running a system-scope
+ * celilo daemon is not a supported shape (see supervisorCommands).
+ */
+export function launchdUnitStatus(scope: SupervisorScope = 'user'): LaunchdUnitStatus | null {
+  if (scope !== 'user' || detectPlatform() !== 'darwin') return null;
+  let out: string;
+  try {
+    out = execFileSync('launchctl', ['list', LAUNCHD_LABEL], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return null;
+  }
+  const pidMatch = out.match(/"PID" = (\d+)/);
+  const exitMatch = out.match(/"LastExitStatus" = (-?\d+)/);
+  return {
+    pid: pidMatch ? Number(pidMatch[1]) : null,
+    lastExitStatus: exitMatch ? Number(exitMatch[1]) : null,
+  };
+}
+
 /**
  * Find the celilo executable. Priority:
  *   1. Explicit override
@@ -185,6 +232,25 @@ export function resolveCeliloPath(override?: string): string {
   return found;
 }
 
+/**
+ * A PATH that resolves bun, for a supervisor unit's environment.
+ *
+ * launchd starts jobs with its own default PATH, and systemd runs
+ * ExecStart with a similarly minimal one. Neither includes bun, and the
+ * global `celilo` entry is a bash wrapper whose first act is
+ * `command -v bun` — so a unit without a PATH key crash-loops forever on
+ * "Error: celilo requires bun" (celilo#1373: 22680 respawns on one Mac).
+ * The PATH is captured at RENDER time — the moment the unit is written —
+ * from Bun.which('bun'), falling back to process.execPath, which IS the
+ * bun binary under the bun runtime. Standard dirs follow so the
+ * dispatcher's own subprocesses keep working.
+ */
+export function resolveDaemonPathEnv(): string {
+  const bun =
+    (Bun as unknown as { which: (cmd: string) => string | null }).which('bun') ?? process.execPath;
+  return `${dirname(bun)}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+}
+
 /**
  * Run-as user for a system-scope unit: the owner of the celilo state
  * dir (the bus DB's directory). Falls back to the current user when
@@ -211,6 +277,11 @@ interface UnitInputs {
   concurrency: number;
   home: string;
   scope: SupervisorScope;
+  /**
+   * PATH injected into the unit's environment (celilo#1373). Required:
+   * a unit without it cannot resolve bun and crash-loops.
+   */
+  pathEnv: string;
   /** Required for system scope; ignored for user scope. */
   runAsUser?: string;
 }
@@ -232,6 +303,7 @@ ${userLine}ExecStart=${input.celiloPath} events run --poll-ms ${input.pollMs} --
 Restart=on-failure
 RestartSec=10s
 Environment=EVENT_BUS_DB=${input.busDbPath}
+Environment=PATH=${input.pathEnv}
 # stdout/stderr are captured by ${journalHint}.
 StandardOutput=journal
 StandardError=journal
@@ -271,6 +343,8 @@ ${userNameBlock}  <key>ProgramArguments</key>
   <dict>
     <key>EVENT_BUS_DB</key>
     <string>${input.busDbPath}</string>
+    <key>PATH</key>
+    <string>${input.pathEnv}</string>
   </dict>
   <key>RunAtLoad</key>
   <true/>
@@ -334,6 +408,7 @@ export function planDaemonInstall(opts: InstallDaemonOptions = {}): InstallDaemo
   const home = opts.home ?? homedir();
   const celiloPath = resolveCeliloPath(opts.celiloPath);
   const busDbPath = opts.busDbPath ?? getEventBusPath();
+  const pathEnv = opts.pathEnv ?? resolveDaemonPathEnv();
   const pollMs = opts.pollMs ?? 1000;
   const concurrency = opts.concurrency ?? 4;
   const runAsUser = scope === 'system' ? resolveRunAsUser(busDbPath, opts.runAsUser) : undefined;
@@ -346,6 +421,7 @@ export function planDaemonInstall(opts: InstallDaemonOptions = {}): InstallDaemo
     concurrency,
     home,
     scope,
+    pathEnv,
     runAsUser,
   };
   const unitContent =

package/src/services/firewall-reach.ts

@@ -57,27 +57,40 @@ export function loadZoneSubnets(db: DbClient): string[] {
 
 /**
  * Read each firewall's live ruleset and pair it with celilo's composed trusted
- * set. A firewall that can't be reached contributes nothing rather than a false
- * "no unowned reach" — an unreadable box is unknown, not clean.
+ * set. Firewalls whose ruleset cannot be read are reported separately, as
+ * `unreachable` — the audit turns each into an `unmeasured` finding, because
+ * an unreadable box is unknown, not clean (D7).
  */
-export function collectFirewallReach(db: DbClient, run: Runner = execRunner): FirewallReachState[] {
+export interface FirewallReachCollection {
+  firewalls: FirewallReachState[];
+  unreachableFirewalls: string[];
+}
+
+export function collectFirewallReach(
+  db: DbClient,
+  run: Runner = execRunner,
+): FirewallReachCollection {
   const zoneSubnets = loadZoneSubnets(db);
-  if (zoneSubnets.length === 0) return [];
+  if (zoneSubnets.length === 0) return { firewalls: [], unreachableFirewalls: [] };
 
-  const states: FirewallReachState[] = [];
+  const firewalls: FirewallReachState[] = [];
+  const unreachableFirewalls: string[] = [];
   for (const firewallIp of listFirewallIps(db)) {
     // escape-hatch: reads the running filter table (`iptables-save`), which is
     // the only place an out-of-band rule appears. Read-only, no capability.
     const result = runAppCommand({ ipv4_address: firewallIp }, 'iptables-save -t filter', run, {
       timeoutMs: IPTABLES_SAVE_TIMEOUT_MS,
     });
-    if (!result.ok) continue;
+    if (!result.ok) {
+      unreachableFirewalls.push(firewallIp);
+      continue;
+    }
 
-    states.push({
+    firewalls.push({
       firewallIp,
       live: parseLiveReachRules(result.stdout, zoneSubnets),
       known: loadTrustedSubnets(db, firewallIp).map((e) => e.subnet),
     });
   }
-  return states;
+  return { firewalls, unreachableFirewalls };
 }

package/src/services/fleet-checks.test.ts

@@ -114,6 +114,41 @@ describe('checkDispatcher', () => {
     expect(f.remediation).toContain('enable --now celilo-events.service');
   });
 
+  // celilo#1373 — the unit is installed and launchd keeps respawning it, but
+  // it dies before it can heartbeat (no PATH → the wrapper can't find
+  // bun). The finding must NAME the crash loop, not tell the operator to
+  // "start the dispatcher".
+  it('names a crash-looping launchd unit when no dispatcher is live (darwin)', () => {
+    installFakeUnit(home);
+    const f = checkDispatcher(bus, {
+      now,
+      home,
+      platform: 'darwin',
+      launchdProbe: () => ({ pid: null, lastExitStatus: 256 }),
+    });
+    expect(f.status).toBe('fail');
+    expect(f.detail.join(' ')).toContain('crash-looping');
+    expect(f.detail.join(' ')).toContain('exit code 1');
+    expect(f.remediation).toContain('celilo events install-daemon');
+  });
+
+  it('does not claim a crash loop when launchd runs the unit or cannot answer', () => {
+    installFakeUnit(home);
+    for (const probe of [
+      () => ({ pid: 4242, lastExitStatus: 256 }), // running despite an old failure
+      () => null, // launchd didn't answer — ignorance, not evidence
+    ]) {
+      const f = checkDispatcher(bus, {
+        now,
+        home,
+        platform: 'darwin',
+        launchdProbe: probe,
+      });
+      expect(f.status).toBe('fail');
+      expect(f.detail.join(' ')).not.toContain('crash-looping');
+    }
+  });
+
   it('passes when running, supervised, current, and not behind on timer ticks', () => {
     seedHeartbeat(bus, { startedAt: now - MINUTE, lastHeartbeat: now - 1000 });
     installFakeUnit(home);
@@ -358,7 +393,8 @@ describe('checkSubscribers + checkCapabilityProviders', () => {
       const f = checkBuildBusPublishing(bus, db, { now });
       expect(f.status).toBe('warn');
       expect(f.summary).toContain('no build-bus publish has ever arrived');
-      expect(f.remediation).toContain('subscribers serve');
+      expect(f.remediation).toContain('subscribers install-daemon');
+      expect(f.remediation).toContain('CELILO_BUS_SECRET');
     });
 
     it('warns when publishes arrive but no hook has ever run', () => {

package/src/services/fleet-checks.ts

@@ -39,9 +39,11 @@ import {
 } from './deployed-systems';
 import { listDnsInternalRecords } from './dns-internal-records';
 import {
+  type LaunchdUnitStatus,
   SUPERVISOR_SCOPES,
   type SupervisorPlatform,
   type SupervisorScope,
+  launchdUnitStatus,
   readInstalledUnit,
   unitMainPid,
 } from './events-daemon';
@@ -196,6 +198,11 @@ export interface DispatcherCheckOptions {
    * no supervision claim rather than guessing.
    */
   unitMainPid?: (scope: SupervisorScope) => number | null;
+  /**
+   * Probe launchd for the unit's health (darwin only — see launchdUnitStatus).
+   * Injected so the crash-loop aspect is testable without launchd.
+   */
+  launchdProbe?: (scope: SupervisorScope) => LaunchdUnitStatus | null;
 }
 
 /**
@@ -228,6 +235,29 @@ export function checkDispatcher(bus: Bus, opts: DispatcherCheckOptions = {}): Fl
     remediations.push(
       'start the dispatcher: `systemctl --user enable --now celilo-events.service` (or `celilo events install-daemon` then enable it)',
     );
+    // A unit can be INSTALLED and still dead: the supervisor respawns a
+    // program that cannot start in the unit's environment and it dies again,
+    // forever. On macOS the classic cause is a PATH-less
+    // EnvironmentVariables dict — the global celilo wrapper needs
+    // `command -v bun`, and launchd's default PATH has none (celilo#1373:
+    // 22680 respawns on one Mac). Name the crash loop instead of telling
+    // the operator to "start the dispatcher".
+    if (opts.platform === 'darwin') {
+      const probe = opts.launchdProbe ?? launchdUnitStatus;
+      const st = probe('user');
+      if (st && st.pid === null && st.lastExitStatus != null && st.lastExitStatus !== 0) {
+        const fate =
+          st.lastExitStatus & 0xff
+            ? `signal ${st.lastExitStatus & 0xff}`
+            : `exit code ${st.lastExitStatus >> 8}`;
+        detail.push(
+          `the installed launchd unit is crash-looping (last ${fate}) — launchd respawns it and it dies again, so no dispatcher ever serves the bus`,
+        );
+        remediations.push(
+          "read the unit's stderr (`tail ~/Library/Logs/celilo-events.err.log`) and reinstall with `celilo events install-daemon` so the unit carries an environment that resolves bun (celilo#1373)",
+        );
+      }
+    }
     // Without a heartbeat there's nothing more to assert about it.
     return {
       id: 'dispatcher',
@@ -449,7 +479,7 @@ export function checkBuildBusPublishing(
       [
         'The webhook receiver (`celilo subscribers serve`) either is not running here or was never sent a verified publish — and nothing in the deploy installs it.',
       ],
-      "start the receiver: `celilo subscribers serve --secret $CELILO_BUS_SECRET` under a supervisor unit, and register this host in the publisher's build-bus-subscribers.json with the same secret (export CELILO_BUS_SECRET in that unit)",
+      "install the receiver under a supervisor unit: `celilo subscribers install-daemon --secret $CELILO_BUS_SECRET` (systemd/launchd; `--print` renders for Ansible), enable it per its next-steps output, and register this host in the publisher's build-bus-subscribers.json with the same secret",
     );
   }