@happier-dev/stack 0.2.1-preview.1775586714.26562 → 0.2.12-preview.1

package/scripts/daemon_invalid_auth_reseed_stack_name.integration.test.mjs

@@ -68,7 +68,42 @@ async function writeStackEnv({ storageDir, stackName, env }) {
   return baseDir;
 }
 
+async function writeStubDistManifest(cliDir) {
+  await writeFile(
+    join(cliDir, 'dist', '.build-manifest.json'),
+    JSON.stringify({ fingerprint: '0000000000000000', fileCount: 1 }) + '\n',
+    'utf-8',
+  );
+}
+
 async function writeStubHappyCli({ cliDir }) {
+  const daemonChildSource = `
+const { createServer } = require('node:http');
+const { mkdirSync, writeFileSync } = require('node:fs');
+const { dirname } = require('node:path');
+const statePath = process.argv[1];
+const controlToken = 'auth-reseed-fixture';
+const server = createServer((req, res) => {
+  if (req.method === 'POST' && req.url === '/ping' && req.headers['x-happier-daemon-token'] === controlToken) {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, distClosureFingerprint: '0000000000000000' }));
+    return;
+  }
+  res.writeHead(404).end();
+});
+server.listen(0, '127.0.0.1', () => {
+  mkdirSync(dirname(statePath), { recursive: true });
+  writeFileSync(statePath, JSON.stringify({
+    pid: process.pid,
+    httpPort: server.address().port,
+    controlToken,
+    startTime: new Date().toISOString(),
+  }) + '\\n', 'utf-8');
+});
+const shutdown = () => server.close(() => process.exit(0));
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
+`;
   const script = `
 import { spawn } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -122,9 +157,8 @@ if (sub === 'start') {
     process.exit(1);
   }
 
-  const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { detached: true, stdio: 'ignore' });
+  const child = spawn(process.execPath, ['-e', ${JSON.stringify(daemonChildSource)}, statePath], { detached: true, stdio: 'ignore' });
   child.unref();
-  writeFileSync(statePath, JSON.stringify({ pid: child.pid, httpPort: 0 }) + '\\n', 'utf-8');
   process.exit(0);
 }
 
@@ -194,6 +228,9 @@ test('invalid-auth auto-reseed uses resolved stack name instead of null placehol
       HAPPIER_STACK_AUTO_AUTH_SEED: '1',
       HAPPIER_STACK_MIGRATE_CREDENTIALS: '0',
       HAPPIER_STACK_CLI_BUILD: '0',
+      HAPPIER_STACK_DAEMON_START_VERIFY_TIMEOUT_MS: '500',
+      HAPPIER_STACK_DAEMON_START_VERIFY_POLL_MS: '10',
+      HAPPIER_STACK_DAEMON_START_VERIFY_STABLE_MS: '0',
     };
 
     profileServer = await startProfileAuthServer({ port: 4101, allowToken: seedToken });
@@ -201,6 +238,8 @@ test('invalid-auth auto-reseed uses resolved stack name instead of null placehol
     await assert.doesNotReject(async () => {
       await startLocalDaemonWithAuth({
         cliBin,
+        cliCommand: process.execPath,
+        cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
         cliHomeDir: targetCliHome,
         internalServerUrl: 'http://127.0.0.1:4101',
         publicServerUrl: 'http://localhost:4101',
@@ -220,6 +259,8 @@ test('invalid-auth auto-reseed uses resolved stack name instead of null placehol
 
     await stopLocalDaemon({
       cliBin,
+      cliCommand: process.execPath,
+      cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
       internalServerUrl: 'http://127.0.0.1:4101',
       cliHomeDir: targetCliHome,
     });
@@ -291,6 +332,9 @@ test('invalid-auth auto-reseed overwrites stale target credentials', async () =>
       HAPPIER_STACK_AUTO_AUTH_SEED: '1',
       HAPPIER_STACK_MIGRATE_CREDENTIALS: '0',
       HAPPIER_STACK_CLI_BUILD: '0',
+      HAPPIER_STACK_DAEMON_START_VERIFY_TIMEOUT_MS: '500',
+      HAPPIER_STACK_DAEMON_START_VERIFY_POLL_MS: '10',
+      HAPPIER_STACK_DAEMON_START_VERIFY_STABLE_MS: '0',
     };
 
     profileServer = await startProfileAuthServer({ port: 4201, allowToken: seedToken });
@@ -298,6 +342,8 @@ test('invalid-auth auto-reseed overwrites stale target credentials', async () =>
     await assert.doesNotReject(async () => {
       await startLocalDaemonWithAuth({
         cliBin,
+        cliCommand: process.execPath,
+        cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
         cliHomeDir: targetCliHome,
         internalServerUrl: 'http://127.0.0.1:4201',
         publicServerUrl: 'http://localhost:4201',
@@ -315,6 +361,8 @@ test('invalid-auth auto-reseed overwrites stale target credentials', async () =>
 
     await stopLocalDaemon({
       cliBin,
+      cliCommand: process.execPath,
+      cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
       internalServerUrl: 'http://127.0.0.1:4201',
       cliHomeDir: targetCliHome,
     });
@@ -418,6 +466,7 @@ if (sub === 'start') {
 	`;
     const cliBin = join(cliDir, 'bin', 'happier.mjs');
     await writeFile(join(cliDir, 'dist', 'index.mjs'), stub.trimStart(), 'utf-8');
+    await writeStubDistManifest(cliDir);
     // If daemon.mjs accidentally invokes bin/happier.mjs, fail loudly.
     await writeFile(cliBin, 'process.exit(42);\n', 'utf-8');
 
@@ -488,6 +537,9 @@ if (sub === 'start') {
       HAPPIER_STACK_AUTO_AUTH_SEED: '1',
       HAPPIER_STACK_MIGRATE_CREDENTIALS: '0',
       HAPPIER_STACK_CLI_BUILD: '0',
+      HAPPIER_STACK_DAEMON_START_VERIFY_TIMEOUT_MS: '500',
+      HAPPIER_STACK_DAEMON_START_VERIFY_POLL_MS: '10',
+      HAPPIER_STACK_DAEMON_START_VERIFY_STABLE_MS: '0',
     };
 
     // Server is reachable but rejects the configured seed token. This should fail closed and must not fall back to main.
@@ -497,6 +549,8 @@ if (sub === 'start') {
       async () => {
         await startLocalDaemonWithAuth({
           cliBin,
+          cliCommand: process.execPath,
+          cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
           cliHomeDir: targetCliHome,
           internalServerUrl: 'http://127.0.0.1:4301',
           publicServerUrl: 'http://localhost:4301',
@@ -527,6 +581,8 @@ if (sub === 'start') {
 
     await stopLocalDaemon({
       cliBin,
+      cliCommand: process.execPath,
+      cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
       internalServerUrl: 'http://127.0.0.1:4301',
       cliHomeDir: targetCliHome,
     });
@@ -610,6 +666,7 @@ if (sub === 'start') {
 	`;
     const cliBin = join(cliDir, 'bin', 'happier.mjs');
     await writeFile(join(cliDir, 'dist', 'index.mjs'), stub.trimStart(), 'utf-8');
+    await writeStubDistManifest(cliDir);
     // If daemon.mjs accidentally invokes bin/happier.mjs, fail loudly.
     await writeFile(cliBin, 'process.exit(42);\n', 'utf-8');
 
@@ -660,11 +717,16 @@ if (sub === 'start') {
       HAPPIER_STACK_AUTO_AUTH_SEED: '1',
       HAPPIER_STACK_MIGRATE_CREDENTIALS: '0',
       HAPPIER_STACK_CLI_BUILD: '0',
+      HAPPIER_STACK_DAEMON_START_VERIFY_TIMEOUT_MS: '500',
+      HAPPIER_STACK_DAEMON_START_VERIFY_POLL_MS: '10',
+      HAPPIER_STACK_DAEMON_START_VERIFY_STABLE_MS: '0',
     };
 
     await assert.rejects(
       startLocalDaemonWithAuth({
         cliBin,
+        cliCommand: process.execPath,
+        cliCommandArgs: [join(cliDir, 'dist', 'index.mjs')],
         cliHomeDir: targetCliHome,
         internalServerUrl: 'http://127.0.0.1:4401',
         publicServerUrl: 'http://localhost:4401',

package/scripts/daemon_server_scope_commands.test.mjs

@@ -1,14 +1,17 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { createServer } from 'node:http';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { resolveStackDaemonStatePaths } from './utils/auth/credentials_paths.mjs';
-import { spawnDetachedInlineNodeTestProcess } from './testkit/core/spawn_test_process.mjs';
+import { writeStubHappierCliFiles } from './testkit/core/stub_happier_cli_files.mjs';
+import { sanitizeStackTestRunnerEnv } from './utils/test/test_env.mjs';
+import { terminateDetachedTestProcess } from './testkit/core/spawn_test_process.mjs';
+import { waitForOwnerDeathWatchdogQuiescence } from './testkit/core/owner_death_watchdog_fixture.mjs';
+import { writeStackRuntimeStateFile } from './utils/stack/runtime_state.mjs';
 
 function stackPaths() {
     const scriptsDir = dirname(fileURLToPath(import.meta.url));
@@ -21,17 +24,21 @@ function stackPaths() {
     };
 }
 
-function runNode(args, { cwd, env, timeoutMs = 15000 }) {
+function runNode(args, { cwd, env, timeoutMs = 30_000 }) {
     return new Promise((resolve, reject) => {
         const proc = spawn(process.execPath, args, {
             cwd,
             env,
+            detached: true,
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         let stdout = '';
         let stderr = '';
-        const timer = setTimeout(() => {
-            proc.kill('SIGKILL');
+        let settled = false;
+        const timer = setTimeout(async () => {
+            if (settled) return;
+            settled = true;
+            await terminateDetachedTestProcess(proc);
             reject(new Error(`timed out after ${timeoutMs}ms\nstdout:\n${stdout}\nstderr:\n${stderr}`));
         }, timeoutMs);
         proc.stdout.on('data', (chunk) => {
@@ -41,10 +48,14 @@ function runNode(args, { cwd, env, timeoutMs = 15000 }) {
             stderr += String(chunk);
         });
         proc.on('error', (error) => {
+            if (settled) return;
+            settled = true;
             clearTimeout(timer);
             reject(error);
         });
         proc.on('exit', (code, signal) => {
+            if (settled) return;
+            settled = true;
             clearTimeout(timer);
             resolve({ code: code ?? (signal ? 1 : 0), signal: signal ?? null, stdout, stderr });
         });
@@ -53,33 +64,60 @@ function runNode(args, { cwd, env, timeoutMs = 15000 }) {
 
 async function createFakeMonorepo(rootDir) {
     await mkdir(join(rootDir, 'node_modules'), { recursive: true });
-    await mkdir(join(rootDir, 'apps', 'cli', 'dist'), { recursive: true });
     await mkdir(join(rootDir, 'apps', 'ui'), { recursive: true });
     await mkdir(join(rootDir, 'apps', 'server'), { recursive: true });
 
     await writeFile(join(rootDir, 'package.json'), JSON.stringify({ name: 'fake-happier-root', private: true }) + '\n', 'utf-8');
-    await writeFile(join(rootDir, 'apps', 'cli', 'package.json'), JSON.stringify({ name: 'fake-cli', private: true }) + '\n', 'utf-8');
+    await writeStubHappierCliFiles(rootDir, {
+        packageJsonContent: JSON.stringify({ name: 'fake-cli', private: true }) + '\n',
+        distIndexScript: 'process.exit(0);\n',
+        binHappierScript: 'process.exit(0);\n',
+    });
     await writeFile(join(rootDir, 'apps', 'ui', 'package.json'), JSON.stringify({ name: 'fake-ui', private: true }) + '\n', 'utf-8');
     await writeFile(
         join(rootDir, 'apps', 'server', 'package.json'),
         JSON.stringify({ name: 'fake-server', private: true, scripts: { start: 'node server.mjs' } }) + '\n',
         'utf-8',
     );
-    await writeFile(join(rootDir, 'apps', 'cli', 'dist', 'index.mjs'), 'process.exit(0);\n', 'utf-8');
 }
 
-function spawnOtherServerDaemon(cliHomeDir) {
-    return spawnDetachedInlineNodeTestProcess('setInterval(() => {}, 1e6)', {
+function spawnOtherServerDaemon(cliHomeDir, env) {
+    return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1e6)'], {
+        detached: true,
         stdio: ['ignore', 'ignore', 'ignore'],
         env: {
-            ...process.env,
+            ...env,
             HAPPIER_HOME_DIR: cliHomeDir,
         },
     });
 }
 
-async function writeRunningDaemonState({ cliHomeDir, serverUrl, pid }) {
-    const paths = resolveStackDaemonStatePaths({ cliHomeDir, serverUrl });
+async function stopOtherServerDaemon(child) {
+    if (!child || child.exitCode !== null || child.signalCode !== null) return;
+    const exited = new Promise((resolve) => child.once('exit', resolve));
+    child.kill('SIGTERM');
+    await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1_000))]);
+    if (child.exitCode === null && child.signalCode === null) {
+        child.kill('SIGKILL');
+        await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1_000))]);
+    }
+}
+
+async function removeFixtureAfterOwnerDeathWatchdog({
+    tempRoot,
+    storageDir,
+    stackName,
+    removePreseededRuntimeState = false,
+}) {
+    if (removePreseededRuntimeState) {
+        await rm(join(storageDir, stackName, 'stack.runtime.json'), { force: true });
+    }
+    await waitForOwnerDeathWatchdogQuiescence({ storageDir, stackName, timeoutMs: 60_000 });
+    await rm(tempRoot, { recursive: true, force: true });
+}
+
+async function writeRunningDaemonState({ cliHomeDir, serverUrl, pid, env }) {
+    const paths = resolveStackDaemonStatePaths({ cliHomeDir, serverUrl, env });
     await mkdir(dirname(paths.serverScopedStatePath), { recursive: true });
     await writeFile(
         paths.serverScopedStatePath,
@@ -88,28 +126,86 @@ async function writeRunningDaemonState({ cliHomeDir, serverUrl, pid }) {
     );
 }
 
-async function withHealthServer(fn) {
-    const server = createServer((req, res) => {
-        if (req.url === '/health') {
-            res.statusCode = 200;
-            res.setHeader('content-type', 'application/json');
-            res.end(JSON.stringify({ service: 'happier-server', status: 'ok' }));
-            return;
-        }
-        res.statusCode = 404;
-        res.end('not found');
+async function withHealthServer({ stackName, envPath, env }, fn) {
+    const child = spawn(process.execPath, ['-e', `
+        const { createServer } = require('node:http');
+        const server = createServer((req, res) => {
+            if (req.url === '/health') {
+                res.statusCode = 200;
+                res.setHeader('content-type', 'application/json');
+                res.end(JSON.stringify({ service: 'happier-server', status: 'ok' }));
+                return;
+            }
+            res.statusCode = 404;
+            res.end('not found');
+        });
+        server.listen(0, '127.0.0.1', () => process.stdout.write(String(server.address().port) + '\\n'));
+    `], {
+        detached: true,
+        env: {
+            ...env,
+            HAPPIER_STACK_STACK: stackName,
+            HAPPIER_STACK_ENV_FILE: envPath,
+            HAPPIER_STACK_PROCESS_KIND: 'server',
+        },
+        stdio: ['ignore', 'pipe', 'ignore'],
     });
-    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-    const address = server.address();
-    const port = typeof address === 'object' && address ? address.port : null;
-    assert.ok(port, 'expected health server port');
+    assert.ok(child.pid && child.stdout, 'expected health server process');
+    let port;
+    try {
+      port = await new Promise((resolve, reject) => {
+        let output = '';
+        const timer = setTimeout(() => reject(new Error('timed out waiting for health server port')), 10_000);
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            output += chunk;
+            const parsed = Number(output.split(/\r?\n/).find(Boolean));
+            if (Number.isInteger(parsed) && parsed > 0) {
+                clearTimeout(timer);
+                resolve(parsed);
+            }
+        });
+        child.once('exit', (code, signal) => {
+            clearTimeout(timer);
+            reject(new Error(`health server exited early (code=${code}, signal=${signal})`));
+        });
+      });
+    } catch (error) {
+      await terminateDetachedTestProcess(child);
+      throw error;
+    }
     try {
-        await fn({ port });
+        await fn({ port, pid: child.pid });
     } finally {
-        await new Promise((resolve) => server.close(resolve));
+        await terminateDetachedTestProcess(child);
     }
 }
 
+async function createListenerOwnershipBoundary({ rootDir, pid, stackName, envPath }) {
+    const binDir = join(rootDir, 'bin');
+    await mkdir(binDir, { recursive: true });
+    await writeFile(join(binDir, 'lsof'), '#!/bin/sh\nprintf "%s\\n" "$OWNED_LISTENER_PID"\n', 'utf8');
+    await writeFile(join(binDir, 'ps'), `#!/bin/sh
+case " $* " in
+  *" eww -p "*)
+    printf 'PID COMMAND\\n'
+    printf '%s node HAPPIER_STACK_STACK=%s HAPPIER_STACK_ENV_FILE=%s HAPPIER_STACK_PROCESS_KIND=server\\n' \
+      "$OWNED_LISTENER_PID" "$OWNED_STACK_NAME" "$OWNED_STACK_ENV_PATH"
+    ;;
+  *" -o pgid= "*) printf '%s\\n' "$OWNED_LISTENER_PID" ;;
+  *) exec /bin/ps "$@" ;;
+esac
+`, 'utf8');
+    await chmod(join(binDir, 'lsof'), 0o755);
+    await chmod(join(binDir, 'ps'), 0o755);
+    return {
+        PATH: `${binDir}:${process.env.PATH ?? ''}`,
+        OWNED_LISTENER_PID: String(pid),
+        OWNED_STACK_NAME: stackName,
+        OWNED_STACK_ENV_PATH: envPath,
+    };
+}
+
 test('hstack dev ignores a running daemon from another server scope', async () => {
     const { repoRoot, devScript } = stackPaths();
     const tempRoot = await mkdtemp(join(tmpdir(), 'hstack-dev-daemon-scope-'));
@@ -119,18 +215,19 @@ test('hstack dev ignores a running daemon from another server scope', async () =
     const cliHomeDir = join(storageDir, stackName, 'cli');
     const otherServerUrl = 'https://other.example.test';
     const currentServerUrl = 'https://current.example.test';
-    const otherDaemon = spawnOtherServerDaemon(cliHomeDir);
+    const isolatedEnv = sanitizeStackTestRunnerEnv(process.env);
+    const otherDaemon = spawnOtherServerDaemon(cliHomeDir, isolatedEnv);
 
     try {
         await createFakeMonorepo(fakeRepo);
-        await writeRunningDaemonState({ cliHomeDir, serverUrl: otherServerUrl, pid: otherDaemon.pid });
+        await writeRunningDaemonState({ cliHomeDir, serverUrl: otherServerUrl, pid: otherDaemon.pid, env: isolatedEnv });
 
         const result = await runNode(
             [devScript, '--no-server', `--server-url=${currentServerUrl}`, '--no-ui', '--no-watch'],
             {
                 cwd: repoRoot,
                 env: {
-                    ...process.env,
+                    ...isolatedEnv,
                     CI: '1',
                     HAPPIER_STACK_REPO_DIR: fakeRepo,
                     HAPPIER_STACK_STORAGE_DIR: storageDir,
@@ -144,12 +241,8 @@ test('hstack dev ignores a running daemon from another server scope', async () =
         assert.doesNotMatch(result.stdout, /dev: already running/);
         assert.match(result.stderr, /daemon auth required/);
     } finally {
-        try {
-            process.kill(-otherDaemon.pid, 'SIGTERM');
-        } catch {
-            // ignore cleanup races
-        }
-        await rm(tempRoot, { recursive: true, force: true });
+        await stopOtherServerDaemon(otherDaemon);
+        await removeFixtureAfterOwnerDeathWatchdog({ tempRoot, storageDir, stackName });
     }
 });
 
@@ -161,17 +254,32 @@ test('hstack start ignores a running daemon from another server scope', async ()
     const stackName = 'scope-start';
     const cliHomeDir = join(storageDir, stackName, 'cli');
     const otherServerUrl = 'http://127.0.0.1:59991';
-    const otherDaemon = spawnOtherServerDaemon(cliHomeDir);
+    const isolatedEnv = sanitizeStackTestRunnerEnv(process.env);
+    const otherDaemon = spawnOtherServerDaemon(cliHomeDir, isolatedEnv);
 
     try {
         await createFakeMonorepo(fakeRepo);
-        await writeRunningDaemonState({ cliHomeDir, serverUrl: otherServerUrl, pid: otherDaemon.pid });
+        await writeRunningDaemonState({ cliHomeDir, serverUrl: otherServerUrl, pid: otherDaemon.pid, env: isolatedEnv });
 
-        await withHealthServer(async ({ port }) => {
+        const envPath = join(storageDir, stackName, 'env');
+        await withHealthServer({ stackName, envPath, env: isolatedEnv }, async ({ port, pid }) => {
+            await writeStackRuntimeStateFile(join(storageDir, stackName, 'stack.runtime.json'), {
+                version: 1,
+                stackName,
+                ports: { server: port },
+                processes: { serverPid: pid },
+            });
+            const ownershipEnv = await createListenerOwnershipBoundary({
+                rootDir: join(tempRoot, 'ownership-boundary'),
+                pid,
+                stackName,
+                envPath,
+            });
             const result = await runNode([runScript, '--no-ui'], {
                 cwd: repoRoot,
                 env: {
-                    ...process.env,
+                    ...isolatedEnv,
+                    ...ownershipEnv,
                     CI: '1',
                     HAPPIER_STACK_REPO_DIR: fakeRepo,
                     HAPPIER_STACK_STORAGE_DIR: storageDir,
@@ -186,11 +294,12 @@ test('hstack start ignores a running daemon from another server scope', async ()
             assert.match(result.stderr, /daemon auth required/);
         });
     } finally {
-        try {
-            process.kill(-otherDaemon.pid, 'SIGTERM');
-        } catch {
-            // ignore cleanup races
-        }
-        await rm(tempRoot, { recursive: true, force: true });
+        await stopOtherServerDaemon(otherDaemon);
+        await removeFixtureAfterOwnerDeathWatchdog({
+            tempRoot,
+            storageDir,
+            stackName,
+            removePreseededRuntimeState: true,
+        });
     }
 });

package/scripts/daemon_server_scoped_state.test.mjs

@@ -1,10 +1,12 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import http from 'node:http';
 import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 
-import { checkDaemonState, cleanupStaleDaemonState } from './daemon.mjs';
+import * as daemonModule from './daemon.mjs';
+import { checkDaemonState, checkDaemonStatePingAware, daemonStateHasLiveProcess } from './daemon.mjs';
 import { spawnDetachedInlineNodeTestProcess } from './testkit/core/spawn_test_process.mjs';
 import { resolveStackDaemonStatePaths } from './utils/auth/credentials_paths.mjs';
 
@@ -29,26 +31,63 @@ test('checkDaemonState reads server-scoped daemon state for active server URL',
   }
 });
 
-test('cleanupStaleDaemonState removes stale server-scoped lock and state', async () => {
-  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-state-'));
+test('checkDaemonStatePingAware requires a live authenticated control ping', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-state-ping-'));
+  let pingOk = false;
+  const server = http.createServer((req, res) => {
+    if (req.method === 'POST' && req.url === '/ping' && req.headers['x-happier-daemon-token'] === 'state-token') {
+      res.statusCode = pingOk ? 200 : 500;
+      res.setHeader('content-type', 'application/json');
+      res.end(JSON.stringify({
+        ok: pingOk,
+        ...(pingOk ? { distClosureFingerprint: 'abcdef1234567890' } : {}),
+      }));
+      return;
+    }
+    res.statusCode = 401;
+    res.end();
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
   try {
-    const serverUrl = 'http://127.0.0.1:4111';
+    const serverUrl = 'http://127.0.0.1:4102';
     const paths = resolveStackDaemonStatePaths({ cliHomeDir: dir, serverUrl });
-    const stalePid = 999999;
-
     await mkdir(dirname(paths.serverScopedStatePath), { recursive: true });
-    await writeFile(paths.serverScopedStatePath, JSON.stringify({ pid: stalePid, httpPort: 4321 }) + '\n', 'utf-8');
-    await writeFile(paths.serverScopedLockPath, `${stalePid}\n`, 'utf-8');
+    await writeFile(
+      paths.serverScopedStatePath,
+      JSON.stringify({
+        pid: process.pid,
+        httpPort: server.address().port,
+        controlToken: 'state-token',
+        startTime: new Date().toISOString(),
+      }) + '\n',
+      'utf-8'
+    );
 
-    await cleanupStaleDaemonState(dir, { serverUrl });
+    pingOk = false;
+    const unreachable = await checkDaemonStatePingAware(dir, { serverUrl });
+    assert.deepEqual(unreachable, { status: 'unreachable', pid: process.pid, reason: 'ping_failed' });
+    assert.equal(daemonStateHasLiveProcess(unreachable), true);
 
-    const after = checkDaemonState(dir, { serverUrl });
-    assert.equal(after.status, 'stopped');
+    pingOk = true;
+    assert.deepEqual(
+      await checkDaemonStatePingAware(dir, { serverUrl }),
+      {
+        status: 'running',
+        pid: process.pid,
+        distClosureFingerprint: 'abcdef1234567890',
+        processInstanceFingerprint: null,
+      },
+    );
   } finally {
+    await new Promise((resolve) => server.close(resolve));
     await rm(dir, { recursive: true, force: true });
   }
 });
 
+test('stack exposes no external daemon-state deletion owner', () => {
+  assert.equal('cleanupStaleDaemonState' in daemonModule, false);
+});
+
 test('checkDaemonState falls back to an older running daemon when the newest fallback state is stale', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-state-'));
   const running = spawnDetachedInlineNodeTestProcess('setInterval(() => {}, 1e6)', {
@@ -60,6 +99,14 @@ test('checkDaemonState falls back to an older running daemon when the newest fal
   });
 
   try {
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+      try {
+        process.kill(running.pid, 0);
+        break;
+      } catch {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+    }
     const olderServerDir = join(dir, 'servers', 'stack_live__id_default');
     const newerServerDir = join(dir, 'servers', 'stack_stale__id_default');
     await mkdir(olderServerDir, { recursive: true });
@@ -77,7 +124,7 @@ test('checkDaemonState falls back to an older running daemon when the newest fal
       'utf-8'
     );
 
-    const state = checkDaemonState(dir, { serverUrl: '' });
+    const state = checkDaemonState(dir, { serverUrl: '', env: {} });
     assert.deepEqual(state, { status: 'running', pid: running.pid });
   } finally {
     try {