harnery 0.42.0 → 0.43.0

package/src/commands/web-fetch.ts

@@ -16,9 +16,11 @@ import type { EmitContext } from "../commander.ts";
  * harnery repo at the *matching version tag* into a cache dir and install the
  * web app's deps. Subsequent runs reuse the cache.
  *
- * The only thing `web/` pulls from `src/` is `harnery/core/journal` (a single,
- * dependency-free module), so the install is `web/` deps only: no root install,
- * no Playwright browser download.
+ * `web/` imports readers from `src/`, and `web/next.config.ts` resolves the
+ * root `playwright` package, so the install covers the repository root and
+ * then `web/`. Installing the `playwright` package downloads no browsers.
+ * Installing `web/` alone left `harn web up` failing with
+ * `Cannot find module 'playwright/package.json'`.
  */
 
 const DEFAULT_REPO_URL = "https://github.com/ryanjkelly/harnery.git";
@@ -53,8 +55,8 @@ function webCacheRoot(ref: string): string {
 }
 
 /** bun if available (preferred), else npm. Both support `<runner> install` and `<runner> run <script>`. */
-export function webRunner(): "bun" | "npm" {
-  const r = spawnSync("bun", ["--version"], { stdio: "ignore" });
+export function webRunner(spawn: typeof spawnSync = spawnSync): "bun" | "npm" {
+  const r = spawn("bun", ["--version"], { stdio: "ignore" });
   return r.status === 0 ? "bun" : "npm";
 }
 
@@ -63,14 +65,20 @@ export function webRunner(): "bun" | "npm" {
  * its path, fetching (clone + install) on first use. Returns null on failure
  * (after emitting an actionable error).
  */
-export function lazyFetchWebRoot(emit: EmitContext): string | null {
+export function lazyFetchWebRoot(
+  emit: EmitContext,
+  spawn: typeof spawnSync = spawnSync,
+): string | null {
   const { version, repoUrl } = readPkg();
   const ref = resolveRef(version);
   const cacheRoot = webCacheRoot(ref);
   const webDir = path.join(cacheRoot, "web");
 
-  // node_modules in the cached web/ is the "fetched + installed" marker.
-  if (existsSync(path.join(webDir, "node_modules"))) {
+  // node_modules in both the cached root and web/ is the "fetched + installed" marker.
+  if (
+    existsSync(path.join(cacheRoot, "node_modules")) &&
+    existsSync(path.join(webDir, "node_modules"))
+  ) {
     emit.log(`harn web · using cached dashboard (${ref})`, "info");
     return webDir;
   }
@@ -85,7 +93,7 @@ export function lazyFetchWebRoot(emit: EmitContext): string | null {
   if (existsSync(cacheRoot)) rmSync(cacheRoot, { recursive: true, force: true });
   mkdirSync(path.dirname(cacheRoot), { recursive: true });
 
-  const clone = spawnSync("git", ["clone", "--depth", "1", "--branch", ref, repoUrl, cacheRoot], {
+  const clone = spawn("git", ["clone", "--depth", "1", "--branch", ref, repoUrl, cacheRoot], {
     stdio: "inherit",
   });
   if (clone.status !== 0) {
@@ -100,16 +108,19 @@ export function lazyFetchWebRoot(emit: EmitContext): string | null {
     return null;
   }
 
-  const runner = webRunner();
-  emit.log(`harn web · installing dashboard deps (${runner} install in web/)`, "info");
-  const install = spawnSync(runner, ["install"], { cwd: webDir, stdio: "inherit" });
-  if (install.status !== 0) {
-    emit.error({
-      code: "web_fetch_failed",
-      message: `${runner} install in ${webDir} failed (status ${install.status})`,
-      hint: `Try manually: cd ${webDir} && ${runner} install`,
-    });
-    return null;
+  const runner = webRunner(spawn);
+  for (const dir of [cacheRoot, webDir]) {
+    const where = dir === webDir ? "web/" : "the harnery root";
+    emit.log(`harn web · installing dashboard deps (${runner} install in ${where})`, "info");
+    const install = spawn(runner, ["install"], { cwd: dir, stdio: "inherit" });
+    if (install.status !== 0) {
+      emit.error({
+        code: "web_fetch_failed",
+        message: `${runner} install in ${dir} failed (status ${install.status})`,
+        hint: `Try manually: cd ${dir} && ${runner} install`,
+      });
+      return null;
+    }
   }
 
   emit.log(`harn web · dashboard ready (cached at ${webDir})`, "info");

package/src/commands/web.ts

@@ -82,11 +82,17 @@ export function nodeOptionsWithHeapCap(mb: number): string | undefined {
   return `${inherited} --max-old-space-size=${mb}`.trim();
 }
 
-/** Preload the request diagnostics hook without replacing Next's HTTP server. */
+/**
+ * Preload the dashboard's server hooks (keep-alive and request diagnostics)
+ * without replacing Next's HTTP server. NODE_OPTIONS reaches the child that
+ * `next dev` forks, but Next re-parses every `--import` into one value, so
+ * this names the single combined preload; a second, different `--import`
+ * would collapse into an unloadable path (web/server-preload.mjs).
+ */
 export function nodeOptionsWithWebDiagnostics(webDir: string, mb: number): string {
   const inherited = nodeOptionsWithHeapCap(mb) ?? "";
-  if (inherited.includes("server-performance.mjs")) return inherited;
-  const preload = pathToFileURL(path.join(webDir, "server-performance.mjs")).href;
+  if (inherited.includes("server-preload.mjs")) return inherited;
+  const preload = pathToFileURL(path.join(webDir, "server-preload.mjs")).href;
   return `${inherited} --import=${preload}`.trim();
 }
 

package/src/core/agents/render/prompt-context.ts

@@ -57,6 +57,7 @@ import {
   readLiveCoordinationRow,
   readLiveCoordinationRows,
 } from "../state/live-coordination-view.ts";
+import { forkRelationLabels } from "../state/names.ts";
 import type { AgentActivity, TaskState } from "../state/session-state.ts";
 import { formatPendingCouncils, recordDeliveredMessages } from "./session-context.ts";
 
@@ -441,7 +442,11 @@ function computePeerTableIfChanged(
   if (oldHash && oldHash === newHash) return "";
 
   // Render peer table via the same formatter used at SessionStart.
-  const local = formatPeerTable(peers, mySessionId);
+  const local = formatPeerTable(
+    peers,
+    mySessionId,
+    forkRelationLabels(coordRoot, selfInstanceId, new Set(peers.map((p) => p.instance_id ?? ""))),
+  );
   const remoteTable = formatRemoteTable(remote);
   const table = [local, remoteTable].filter(Boolean).join("\n\n");
   if (!table) return "";
@@ -580,7 +585,11 @@ function writeHashFile(path: string, value: string): void {
  * (no cross-file imports of formatting internals). If both renderers diverge,
  * pull the shared bits into a small util module. */
 
-function formatPeerTable(peers: HeartbeatRow[], mySessionId: string): string {
+function formatPeerTable(
+  peers: HeartbeatRow[],
+  mySessionId: string,
+  relations: Map<string, string> = new Map(),
+): string {
   if (peers.length === 0) return "";
   const nowSec = Math.floor(Date.now() / 1000);
 
@@ -592,16 +601,20 @@ function formatPeerTable(peers: HeartbeatRow[], mySessionId: string): string {
     }
   }
 
-  type RowExt = HeartbeatRow & { display_files: string[] };
+  type RowExt = HeartbeatRow & { display_files: string[]; relation?: string };
   const rows: RowExt[] = peers
     .filter((p) => (p.kind ?? "unknown") !== "transient")
     .map((p) => {
       const folded = fold[p.instance_id ?? ""] ?? [];
       const display = Array.from(new Set([...(p.files_touched ?? []), ...folded])).sort();
-      return { ...p, display_files: display };
+      const relation = relations.get(p.instance_id ?? "");
+      return { ...p, display_files: display, ...(relation ? { relation } : {}) };
     });
 
-  const blocking = rows.filter((p) => p.session_id !== mySessionId).sort(byStartedAt);
+  // Related sessions sort first so a fork parent never hides in "+N more".
+  const blocking = rows
+    .filter((p) => p.session_id !== mySessionId)
+    .sort((a, b) => Number(!!b.relation) - Number(!!a.relation) || byStartedAt(a, b));
   const group = rows.filter((p) => p.session_id === mySessionId).sort(byStartedAt);
 
   const out: string[] = [];
@@ -625,7 +638,7 @@ function byStartedAt(a: HeartbeatRow, b: HeartbeatRow): number {
 }
 
 function renderSubtable(
-  rows: Array<HeartbeatRow & { display_files: string[] }>,
+  rows: Array<HeartbeatRow & { display_files: string[]; relation?: string }>,
   header: string,
   nowSec: number,
 ): string {
@@ -635,7 +648,10 @@ function renderSubtable(
   return `${header}\n${first.join("\n")}${overflow}`;
 }
 
-function formatRow(r: HeartbeatRow & { display_files: string[] }, nowSec: number): string {
+function formatRow(
+  r: HeartbeatRow & { display_files: string[]; relation?: string },
+  nowSec: number,
+): string {
   const taskPart = r.task ? ` "${r.task.slice(0, 60)}"` : "";
   const statePart = formatState(r);
   // Fall back started_at → last_heartbeat; if neither is a valid timestamp,
@@ -646,7 +662,8 @@ function formatRow(r: HeartbeatRow & { display_files: string[] }, nowSec: number
   // Prefer a short instance_id over a bare "unknown" so an incomplete row is
   // still identifiable.
   const label = r.name ?? (r.instance_id ? r.instance_id.slice(0, 8) : "unknown");
-  return `  - agent-${label}${taskPart}   (${statePart}, ${ageFrom}, ${filesPart})`;
+  const relation = r.relation ? ` [${r.relation}]` : "";
+  return `  - agent-${label}${relation}${taskPart}   (${statePart}, ${ageFrom}, ${filesPart})`;
 }
 
 function formatState(r: HeartbeatRow): string {

package/src/core/agents/render/session-context.ts

@@ -16,7 +16,7 @@ import { appendEntry } from "../../journal/index.ts";
 import { readRemoteMachines } from "../../presence/index.ts";
 import { drainMailbox, formatMailboxDelivery, type MailboxMessageV1 } from "../mailbox.ts";
 import { readLiveCoordinationRows } from "../state/live-coordination-view.ts";
-import { readForkParent } from "../state/names.ts";
+import { forkRelationLabels, readForkState } from "../state/names.ts";
 import type { AgentActivity, TaskState } from "../state/session-state.ts";
 
 interface HeartbeatRow {
@@ -54,7 +54,17 @@ export function renderSessionContext(opts: RenderOpts): string {
 
   // 1. Self-name line + peer table (folded if peers present)
   const peers = readActivePeers(coordRoot, instanceId);
-  const localTable = formatPeerTable(peers, sessionId);
+  const forkState = readForkState(coordRoot, instanceId);
+  const forkParent = forkState?.parent ?? null;
+  const parentRow = forkParent
+    ? peers.find((peer) => peer.instance_id === forkParent.instance_id)
+    : undefined;
+  const relations = forkRelationLabels(
+    coordRoot,
+    instanceId,
+    new Set(peers.map((peer) => peer.instance_id ?? "")),
+  );
+  const localTable = formatPeerTable(peers, sessionId, relations);
   // Cross-machine presence (ADR 0016): sessions on other machines (advisory).
   const peerTable = [localTable, formatRemoteMachines(coordRoot)].filter(Boolean).join("\n\n");
   if (agentName) {
@@ -64,13 +74,11 @@ export function renderSessionContext(opts: RenderOpts): string {
     // asserts the parent's name, claims, and task. When recorded fork lineage
     // (.name-history forked_from) names the parent, say so specifically — the
     // fork is about to read a transcript full of that exact name. Otherwise
-    // fall back to the generic clause, which needs no fork detection.
-    const forkParent = readForkParent(coordRoot, instanceId);
-    const authority = forkParent?.name
-      ? `This conversation was branched from agent-${forkParent.name}'s session: earlier context showing agent-${forkParent.name}'s name, task, or file claims belongs to the pre-fork session, not to you.`
-      : forkParent
-        ? `This conversation was branched from another session (${forkParent.instance_id}); any agent name in earlier context belongs to that session, not to you.`
-        : "Any different agent name in earlier context was inherited from another session; this one is authoritative.";
+    // fall back to the generic clause, which needs no fork detection. A live
+    // parent is the dangerous case (2026-10-07: a fork read its running
+    // parent as its own earlier self and offered to close it), so the notice
+    // names what the parent is doing and forbids ending it.
+    const authority = forkAuthorityClause(forkParent, forkState?.fork === true, parentRow);
     const selfLine = `You are agent-${agentName}${suffix}. ${authority}`;
     messages.push(peerTable ? `${selfLine}\n\n${peerTable}` : selfLine);
   } else if (peerTable) {
@@ -194,13 +202,64 @@ function readActivePeers(coordRoot: string, selfInstanceId: string): HeartbeatRo
   );
 }
 
+const DO_NOT_END =
+  "Do not end, release, or finalize that session unless the operator explicitly tells you to.";
+
+function forkAuthorityClause(
+  parent: { instance_id: string; name: string | null } | null,
+  fork: boolean,
+  parentRow: HeartbeatRow | undefined,
+): string {
+  if (parent?.name && parentRow) {
+    const files = parentRow.files_touched ?? [];
+    const task = parentRow.task ? ` on "${parentRow.task.slice(0, 80)}"` : "";
+    const holds =
+      files.length > 0
+        ? ` and holds ${files.length} file${files.length === 1 ? "" : "s"} (${fmtFileList(files)})`
+        : "";
+    const owned =
+      files.length > 0
+        ? parentRow.task
+          ? "That name, task, and those files"
+          : "That name and those files"
+        : parentRow.task
+          ? "That name and task"
+          : "That name";
+    return (
+      `This conversation was forked from agent-${parent.name}, which is still running as a separate session${task}${holds}. ` +
+      `${owned} belong${owned === "That name" ? "s" : ""} to agent-${parent.name}, not to you. ${DO_NOT_END}`
+    );
+  }
+  if (parent?.name) {
+    return `This conversation was branched from agent-${parent.name}'s session: earlier context showing agent-${parent.name}'s name, task, or file claims belongs to the pre-fork session, not to you.`;
+  }
+  if (parent) {
+    return `This conversation was branched from another session (${parent.instance_id}); any agent name in earlier context belongs to that session, not to you.`;
+  }
+  if (fork) {
+    return `This conversation was forked from another session, which may still be running. Any agent name, task, or file claim in earlier context belongs to that session, not to you. ${DO_NOT_END}`;
+  }
+  return "Any different agent name in earlier context was inherited from another session; this one is authoritative.";
+}
+
+function fmtFileList(files: string[]): string {
+  const sorted = [...files].sort();
+  return sorted.length <= 3
+    ? sorted.join(", ")
+    : `${sorted.slice(0, 3).join(", ")}, +${sorted.length - 3} more`;
+}
+
 /**
  * Renders the peer table as
  * two subsections: "Other agent groups active" (blocking) and "Your group"
  * (subagents/siblings, no mutual block). Folds transient subagents' files
  * into their parent session.
  */
-function formatPeerTable(peers: HeartbeatRow[], mySessionId: string): string {
+function formatPeerTable(
+  peers: HeartbeatRow[],
+  mySessionId: string,
+  relations: Map<string, string> = new Map(),
+): string {
   if (peers.length === 0) return "";
   const nowSec = Math.floor(Date.now() / 1000);
 
@@ -214,16 +273,20 @@ function formatPeerTable(peers: HeartbeatRow[], mySessionId: string): string {
   }
 
   // Build rows with display_files (own files + folded transient files).
-  type RowExt = HeartbeatRow & { display_files: string[] };
+  type RowExt = HeartbeatRow & { display_files: string[]; relation?: string };
   const rows: RowExt[] = peers
     .filter((p) => (p.kind ?? "unknown") !== "transient")
     .map((p) => {
       const folded = fold[p.instance_id ?? ""] ?? [];
       const display = Array.from(new Set([...(p.files_touched ?? []), ...folded])).sort();
-      return { ...p, display_files: display };
+      const relation = relations.get(p.instance_id ?? "");
+      return { ...p, display_files: display, ...(relation ? { relation } : {}) };
     });
 
-  const blocking = rows.filter((p) => p.session_id !== mySessionId).sort(byStartedAt);
+  // Related sessions sort first so the parent never hides in "+N more".
+  const blocking = rows
+    .filter((p) => p.session_id !== mySessionId)
+    .sort((a, b) => Number(!!b.relation) - Number(!!a.relation) || byStartedAt(a, b));
   const group = rows.filter((p) => p.session_id === mySessionId).sort(byStartedAt);
 
   const sections: string[] = [];
@@ -248,7 +311,7 @@ function byStartedAt(a: HeartbeatRow, b: HeartbeatRow): number {
 }
 
 function renderSubtable(
-  rows: Array<HeartbeatRow & { display_files: string[] }>,
+  rows: Array<HeartbeatRow & { display_files: string[]; relation?: string }>,
   header: string,
   nowSec: number,
 ): string {
@@ -258,7 +321,10 @@ function renderSubtable(
   return `${header}\n${first.join("\n")}${overflow}`;
 }
 
-function formatRow(r: HeartbeatRow & { display_files: string[] }, nowSec: number): string {
+function formatRow(
+  r: HeartbeatRow & { display_files: string[]; relation?: string },
+  nowSec: number,
+): string {
   const taskPart = r.task ? ` "${r.task.slice(0, 60)}"` : "";
   const activity = r.activity ?? "unknown";
   const lifecycle = r.task_state ?? "active";
@@ -266,7 +332,8 @@ function formatRow(r: HeartbeatRow & { display_files: string[] }, nowSec: number
     lifecycle === "blocked" && r.task_state_reason ? `: ${r.task_state_reason.slice(0, 80)}` : "";
   const ageFrom = fmtAge(nowSec - parseIsoSec(r.started_at));
   const filesPart = fmtFiles(r.display_files);
-  return `  - agent-${r.name ?? "unknown"}${taskPart}   (activity=${activity}, lifecycle=${lifecycle}${reason}, ${ageFrom}, ${filesPart})`;
+  const relation = r.relation ? ` [${r.relation}]` : "";
+  return `  - agent-${r.name ?? "unknown"}${relation}${taskPart}   (activity=${activity}, lifecycle=${lifecycle}${reason}, ${ageFrom}, ${filesPart})`;
 }
 
 function fmtFiles(files: string[]): string {

package/src/core/agents/state/names.ts

@@ -331,13 +331,20 @@ export interface NameHistoryRow {
   ts: string;
   /** Durable persona UUID. Present after `agents identity assume`. */
   agent_id?: string;
-  /** Audit marker distinguishing an explicit role adoption from pool assignment. */
-  source?: "pool" | "identity.assume";
+  /** Audit marker distinguishing an explicit role adoption from pool assignment,
+   * and a lineage row appended after the name was already assigned. */
+  source?: "pool" | "identity.assume" | "fork.detected";
   previous_name?: string;
   /** Instance this session was forked/branched from (recorded fork lineage).
    * Stamped only on the row that first assigns this instance, when the adapter
    * layer detected or supplied a parent conversation. */
   forked_from?: string;
+  /** The adapter declared or inherited-history proved this instance is a fork,
+   * even when its parent could not be resolved yet. */
+  fork?: true;
+  /** Fork detection has run against this instance's transcript; the tool-path
+   * heal skips instances carrying it so the scan runs once per instance. */
+  fork_checked?: true;
 }
 
 function atomicWrite(path: string, content: string): void {
@@ -516,7 +523,13 @@ export function assignName(
   coordRoot: string,
   instanceId: string,
   kind: NameKind,
-  opts: { freshnessSecs: number; forkedFrom?: string; nowMs?: number },
+  opts: {
+    freshnessSecs: number;
+    forkedFrom?: string;
+    fork?: boolean;
+    forkChecked?: boolean;
+    nowMs?: number;
+  },
 ): string {
   // Check 1: existing history row → original name. A resume re-enters here,
   // which also makes fork stamping naturally idempotent: lineage lands only on
@@ -558,13 +571,111 @@ export function assignName(
     kind,
     source: "pool",
     ...(forkedFrom && forkedFrom !== instanceId ? { forked_from: forkedFrom } : {}),
+    ...(opts.fork || (forkedFrom && forkedFrom !== instanceId) ? { fork: true as const } : {}),
+    ...(opts.forkChecked ? { fork_checked: true as const } : {}),
     ts: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
   });
   return name;
 }
 
+export interface ForkState {
+  /** True when the instance is a recorded fork, parent known or not. */
+  fork: boolean;
+  /** Detection already ran for this instance. */
+  checked: boolean;
+  parent: { instance_id: string; name: string | null } | null;
+}
+
+/** Recorded fork state for <instanceId>, or null when it has no history row. */
+export function readForkState(coordRoot: string, instanceId: string): ForkState | null {
+  const history = readHistory(coordRoot);
+  let seen = false;
+  let fork = false;
+  let checked = false;
+  let parentId: string | undefined;
+  for (const row of history) {
+    if (row.instance_id !== instanceId) continue;
+    seen = true;
+    if (row.fork || row.forked_from) fork = true;
+    if (row.fork_checked) checked = true;
+    if (row.forked_from && row.forked_from !== instanceId) parentId = row.forked_from;
+  }
+  if (!seen) return null;
+  const parent = parentId
+    ? { instance_id: parentId, name: resolveName(coordRoot, parentId)?.name ?? null }
+    : null;
+  return { fork, checked, parent };
+}
+
+/**
+ * Record fork detection that ran after the instance was already named (the
+ * tool-path heal). Appends a copy of the latest identity row, so the name,
+ * kind, and persona are unchanged, plus `fork_checked` and any lineage found.
+ * A no-op for an instance with no history row or one already checked.
+ */
+export function recordForkDetection(
+  coordRoot: string,
+  instanceId: string,
+  detection: { fork: boolean; forkedFrom?: string },
+): boolean {
+  const history = readHistory(coordRoot);
+  let latest: NameHistoryRow | undefined;
+  for (const row of history) {
+    if (row.instance_id !== instanceId) continue;
+    if (row.fork_checked) return false;
+    latest = row;
+  }
+  if (!latest) return false;
+  const forkedFrom =
+    detection.forkedFrom && detection.forkedFrom !== instanceId ? detection.forkedFrom : undefined;
+  appendHistory(coordRoot, {
+    instance_id: instanceId,
+    name: latest.name,
+    kind: latest.kind,
+    ...(latest.agent_id ? { agent_id: latest.agent_id } : {}),
+    source: "fork.detected",
+    ...(forkedFrom ? { forked_from: forkedFrom } : {}),
+    ...(detection.fork || forkedFrom || latest.fork ? { fork: true as const } : {}),
+    fork_checked: true,
+    ts: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
+  });
+  return true;
+}
+
+/**
+ * Peer labels for recorded fork relations, keyed by instance id: this
+ * session's fork parent and its direct forks. `liveIds` marks which of them
+ * are running, so a fork can tell its live parent from its own earlier self.
+ */
+export function forkRelationLabels(
+  coordRoot: string,
+  instanceId: string,
+  liveIds: Set<string>,
+): Map<string, string> {
+  const out = new Map<string, string>();
+  const parent = readForkParent(coordRoot, instanceId);
+  if (parent) {
+    out.set(
+      parent.instance_id,
+      liveIds.has(parent.instance_id) ? "your fork parent, live" : "your fork parent",
+    );
+  }
+  for (const child of readForkChildren(coordRoot, instanceId)) out.set(child, "your fork");
+  return out;
+}
+
+/** Instance ids recorded as direct forks of <instanceId>. */
+export function readForkChildren(coordRoot: string, instanceId: string): Set<string> {
+  const out = new Set<string>();
+  for (const row of readHistory(coordRoot)) {
+    if (row.forked_from === instanceId && row.instance_id !== instanceId) out.add(row.instance_id);
+  }
+  return out;
+}
+
 /** One step of recorded fork lineage: the latest row for <instanceId> that
- * carries `forked_from` (latest-row-wins, matching resolveName). */
+ * carries `forked_from`. Later rows without lineage (an identity assumption)
+ * do not erase it: a session never stops being a fork. */
 export function readForkParent(
   coordRoot: string,
   instanceId: string,
@@ -572,8 +683,8 @@ export function readForkParent(
   const history = readHistory(coordRoot);
   for (let i = history.length - 1; i >= 0; i--) {
     const row = history[i]!;
-    if (row.instance_id !== instanceId) continue;
-    if (!row.forked_from) return null;
+    if (row.instance_id !== instanceId || !row.forked_from) continue;
+    if (row.forked_from === instanceId) return null;
     const parent = resolveName(coordRoot, row.forked_from);
     return { instance_id: row.forked_from, name: parent?.name ?? null };
   }

package/src/core/events/v3/support-storage/pack-reader.ts

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
-import { constants, createReadStream } from "node:fs";
+import { constants } from "node:fs";
 import { lstat, mkdir, open, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
 import { StringDecoder } from "node:string_decoder";
 import { createGunzip, createInflateRaw } from "node:zlib";
 import { stateDirMode, stateFileMode } from "../../../storage/modes.ts";
@@ -89,24 +91,17 @@ async function* streamEventV3SupportPackRecordsForManifest(
       throw new Error("event_v3_support_payload_length_mismatch");
     if (payloadStat.size > bounded.max_payload_bytes)
       throw new Error("event_v3_support_payload_too_large");
-    if ((await hashHandle(payloadPath, payloadHandle)) !== manifest.payload.digest) {
+    if ((await hashHandle(payloadHandle)) !== manifest.payload.digest) {
       throw new Error("event_v3_support_payload_digest_mismatch");
     }
     limits.fault?.("after_payload_digest", payloadPath);
     await assertCanonicalSingleGzipMember(
-      payloadPath,
       payloadHandle,
       payloadStat.size,
       bounded.max_decompressed_bytes,
     );
 
     const gunzip = createGunzip();
-    const source = createReadStream(payloadPath, {
-      fd: payloadHandle.fd,
-      autoClose: false,
-      start: 0,
-    });
-    source.pipe(gunzip);
     const decoder = new StringDecoder("utf8");
     let pending = "";
     let decompressedBytes = 0;
@@ -116,7 +111,7 @@ async function* streamEventV3SupportPackRecordsForManifest(
     const entries: EventV3LogicalAuthorityEntry[] = [];
     const seen = new Set<string>();
 
-    for await (const current of gunzip) {
+    for await (const current of decompressHandle(payloadHandle, 0, gunzip)) {
       const chunk = current as Buffer;
       decompressedBytes += chunk.length;
       if (decompressedBytes > bounded.max_decompressed_bytes) {
@@ -247,16 +242,49 @@ export async function unpackEventV3SupportPack(
   }
 }
 
-async function hashHandle(
-  path: string,
-  handle: Awaited<ReturnType<typeof open>>,
-): Promise<`sha256:${string}`> {
+async function hashHandle(handle: Awaited<ReturnType<typeof open>>): Promise<`sha256:${string}`> {
   const hash = createHash("sha256");
-  const stream = createReadStream(path, { fd: handle.fd, autoClose: false, start: 0 });
-  for await (const current of stream) hash.update(current as Buffer);
+  for await (const current of handleChunks(handle, 0)) hash.update(current);
   return `sha256:${hash.digest("hex")}`;
 }
 
+async function* handleChunks(handle: Awaited<ReturnType<typeof open>>, position: number) {
+  while (true) {
+    const buffer = Buffer.alloc(64 * 1024);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+    if (bytesRead === 0) return;
+    position += bytesRead;
+    yield buffer.subarray(0, bytesRead);
+  }
+}
+
+async function* decompressHandle(
+  handle: Awaited<ReturnType<typeof open>>,
+  start: number,
+  decoder: ReturnType<typeof createGunzip>,
+): AsyncGenerator<Buffer> {
+  const source = Readable.from(handleChunks(handle, start));
+  // Observe failures immediately, then settle source reads before the caller
+  // can close and reuse the verified handle, including on early rejection.
+  const completed = finished(source, { cleanup: true }).then(
+    () => undefined,
+    (error: unknown) => error,
+  );
+  source.once("error", (error) => decoder.destroy(error));
+  source.pipe(decoder);
+  try {
+    for await (const chunk of decoder) yield chunk as Buffer;
+    source.unpipe(decoder);
+    source.resume();
+    const error = await completed;
+    if (error) throw error;
+  } finally {
+    source.destroy();
+    decoder.destroy();
+    await completed;
+  }
+}
+
 async function realDirectory(path: string): Promise<string> {
   const stat = await lstat(path);
   if (!stat.isDirectory() || stat.isSymbolicLink())
@@ -265,7 +293,6 @@ async function realDirectory(path: string): Promise<string> {
 }
 
 async function assertCanonicalSingleGzipMember(
-  path: string,
   handle: Awaited<ReturnType<typeof open>>,
   payloadBytes: number,
   maximumDecompressedBytes: number,
@@ -284,9 +311,8 @@ async function assertCanonicalSingleGzipMember(
     throw new Error("event_v3_support_gzip_header_noncanonical");
   }
   const inflate = createInflateRaw();
-  createReadStream(path, { fd: handle.fd, autoClose: false, start: 10 }).pipe(inflate);
   let decompressed = 0;
-  for await (const current of inflate) {
+  for await (const current of decompressHandle(handle, 10, inflate)) {
     decompressed += (current as Buffer).length;
     if (decompressed > maximumDecompressedBytes) {
       inflate.destroy();