feat: complete CLI milestone

Finish the Milestone 4 CLI surface with config management, daemon
install and uninstall helpers, config reload handling, and final
polish for secret redaction and running-socket tracking.

ROADMAP.md

@@ -7,15 +7,14 @@
 
 ## Current Focus
 
-**Milestone 4 — CLI**
-Daemon core is complete. Continue broadening CLI coverage against the running daemon.
+**Milestone 5 — HTTP API**
+CLI coverage is complete. Begin exposing the same surface over loopback HTTP.
 
 ---
 
 ## In Progress
 
-- Milestone 4 is underway with working `daemon`, `device`, and app-cache commands over the Unix socket
-- Remaining CLI work is remote/state/dev/config coverage plus daemon install/uninstall helpers
+- Milestone 5 has not started yet; CLI validation and polish are complete enough to move on
 
 ---
 
@@ -77,26 +76,26 @@ _Goal: All tvctl commands work against a running daemon._
 
 - [x] 2026-04-14 — CLI entry point and dispatch (`src/cli/mod.rs`)
 - [x] 2026-04-14 — Unix socket client (send commands, receive responses)
-- [ ] `tvctl daemon` commands
-  - `start` `stop` `restart` `status`
-  - `install` (generate systemd user unit)
-  - `uninstall`
-- [ ] `tvctl device` commands
-  - `list` `discover` `add` `select` `info` `remove`
+- [x] 2026-04-14 `tvctl daemon` commands
+  - [x] `start` `stop` `restart` `status`
+  - [x] `install` (generate systemd user unit)
+  - [x] `uninstall`
+- [x] 2026-04-14 `tvctl device` commands
+  - [x] `list` `discover` `add` `select` `info` `remove`
 - [ ] `tvctl app` commands
-  - `list` `launch` `stop` `refresh`
+  - [x] 2026-04-14 `list` `launch` `stop` `refresh`
 - [ ] `tvctl remote` commands
-  - `key` `sequence`
-- [ ] `tvctl state`
-- [ ] `tvctl dev` commands
-  - `install` `reload` `logs`
-- [ ] `tvctl config` commands
-  - `list` `get` `set` `reset` `reload`
-- [ ] Global flags: `--device` `--json` `--help` `--version`
-- [ ] Full help text on every command (see AGENT.md definition of done)
-- [ ] Full help output on bare `tvctl`
-- [ ] Friendly error messages with hints on every failure path
-- [ ] `--json` output verified on every command
+  - [x] 2026-04-14 `key` `sequence`
+- [x] 2026-04-14 `tvctl state`
+- [x] 2026-04-14 `tvctl dev` commands
+  - [x] `install` `reload` `logs`
+- [x] 2026-04-14 `tvctl config` commands
+  - [x] `list` `get` `set` `reset` `reload`
+- [x] 2026-04-14 Global flags: `--device` `--json` `--help` `--version`
+- [x] 2026-04-14 Full help text on every command (see AGENT.md definition of done)
+- [x] 2026-04-14 Full help output on bare `tvctl`
+- [x] 2026-04-14 Friendly error messages with hints on every failure path
+- [x] 2026-04-14 `--json` output verified on every command
 
 ---
 
@@ -162,6 +161,9 @@ out of scope until Milestone 6 is complete and stable.
 - [x] 2026-04-14 — Add daemon config loading, runtime paths, persisted registry/cache stores, and discovery foundations
 - [x] 2026-04-14 — Add daemon Unix socket IPC plus working `daemon` and `device` lifecycle/discovery commands
 - [x] 2026-04-14 — Finish Milestone 3 with registry CRUD, periodic discovery, manual add, and app-cache refresh plus live daemon validation
+- [x] 2026-04-14 — Add daemon-backed app control, remote input, state queries, and dev workflows with live Roku CLI validation
+- [x] 2026-04-14 — Add config list/get/set/reset/reload plus systemd user-service install/uninstall commands
+- [x] 2026-04-14 — Finish Milestone 4 with help, JSON-mode, config socket-reload, and secret-redaction polish
 
 ---