harnery 0.45.0 → 0.45.2

package/src/core/agents/state/service-process.ts

@@ -0,0 +1,217 @@
+/**
+ * One owner check for every singleton background service (governor, local
+ * supervisor, legacy resource observer): is the recorded process still the
+ * run that wrote the record, and how is a stop requested?
+ */
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { writePrivateJsonAtomic } from "../../storage/atomic-json.ts";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
+import {
+  type ProcessGenerationSignalDependencies,
+  type ProcessGenerationVerdict,
+  processStartToken,
+  signalIfSameGeneration,
+  verifyProcessGeneration,
+} from "./proc-start.ts";
+
+export interface ServiceProcessDependencies extends ProcessGenerationSignalDependencies {
+  /** Throws ESRCH, or returns false, when the process is gone. */
+  probePid?: (pid: number) => unknown;
+}
+
+export type ServiceLiveness = "running" | "stopped" | "unknown";
+
+export interface ServiceProcessOwner {
+  pid: number;
+  host: string;
+  start_token?: string;
+  state?: string;
+}
+
+/**
+ * A stale heartbeat does not prove that a process has exited. Another host, a
+ * probe error other than ESRCH, or an unverifiable token answers unknown. A
+ * recorded `stopped` state counts only while the generation still matches.
+ */
+export function observeServiceProcess(
+  owner: ServiceProcessOwner,
+  dependencies: ServiceProcessDependencies = {},
+): { generation: ProcessGenerationVerdict; liveness: ServiceLiveness } {
+  if (owner.host !== hostname()) return { generation: "unknown", liveness: "unknown" };
+  try {
+    if ((dependencies.probePid ?? ((pid) => process.kill(pid, 0)))(owner.pid) === false)
+      return { generation: "unknown", liveness: "stopped" };
+  } catch (error) {
+    return {
+      generation: "unknown",
+      liveness: (error as NodeJS.ErrnoException).code === "ESRCH" ? "stopped" : "unknown",
+    };
+  }
+  const generation = verifyProcessGeneration(owner.pid, owner.start_token, dependencies.readToken);
+  return {
+    generation,
+    liveness:
+      generation === "same"
+        ? owner.state === "stopped"
+          ? "stopped"
+          : "running"
+        : generation === "different"
+          ? "stopped"
+          : "unknown",
+  };
+}
+
+/** Refuse a start while another owner runs or cannot be identified. */
+export function serviceStartRefusal(
+  label: string,
+  stopCommand: string,
+  pid: number | undefined,
+  liveness: ServiceLiveness,
+): Error {
+  return new Error(
+    liveness === "running"
+      ? `${label} is already running under pid ${pid}`
+      : `${label} process generation is unknown${pid ? ` for pid ${pid}` : ""}; run \`${stopCommand}\` to write a durable stop request before starting it again`,
+  );
+}
+
+export interface ServiceLease {
+  pid: number;
+  start_token?: string;
+  host: string;
+  nonce: string;
+  created_at?: string;
+}
+
+export function readServiceLease(path: string): ServiceLease | undefined {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8")) as Partial<ServiceLease>;
+    if (
+      !Number.isSafeInteger(value.pid) ||
+      (value.pid ?? 0) <= 0 ||
+      typeof value.host !== "string" ||
+      !value.host ||
+      typeof value.nonce !== "string" ||
+      !value.nonce
+    )
+      return undefined;
+    return {
+      ...value,
+      start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+    } as ServiceLease;
+  } catch {
+    return undefined;
+  }
+}
+
+/** An absent lease is stopped; an unreadable one cannot be identified. */
+export function serviceLeaseOwner(path: string): {
+  lease?: ServiceLease;
+  liveness: ServiceLiveness;
+} {
+  if (!existsSync(path)) return { liveness: "stopped" };
+  const lease = readServiceLease(path);
+  return { lease, liveness: lease ? observeServiceProcess(lease).liveness : "unknown" };
+}
+
+/**
+ * Take the singleton lease with an exclusive create. A lease whose owner is
+ * proven stopped is replaced; any other owner refuses the start.
+ */
+export function acquireServiceLease(
+  path: string,
+  refuse: (pid: number | undefined, liveness: ServiceLiveness) => Error,
+  fields: Record<string, unknown> = {},
+): { nonce: string; release: () => void } {
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const startToken = processStartToken(process.pid);
+    const lease = {
+      ...fields,
+      pid: process.pid,
+      ...(startToken ? { start_token: startToken } : {}),
+      host: hostname(),
+      nonce: randomUUID(),
+      created_at: new Date().toISOString(),
+    };
+    try {
+      const fd = openSync(path, "wx", stateFileMode());
+      try {
+        writeFileSync(fd, `${JSON.stringify(lease)}\n`, "utf8");
+      } finally {
+        closeSync(fd);
+      }
+      return {
+        nonce: lease.nonce,
+        release: () => {
+          if (readServiceLease(path)?.nonce !== lease.nonce) return;
+          try {
+            unlinkSync(path);
+          } catch {
+            // A missing lease is already released.
+          }
+        },
+      };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const owner = serviceLeaseOwner(path);
+      if (owner.liveness !== "stopped") throw refuse(owner.lease?.pid, owner.liveness);
+      try {
+        unlinkSync(path);
+      } catch {
+        // A concurrent starter may have replaced or removed the stale lease.
+      }
+    }
+  }
+  throw new Error(`could not acquire the singleton lease at ${path}`);
+}
+
+export interface ServiceStopFields {
+  signal_sent: boolean;
+  signal_verdict: ProcessGenerationVerdict;
+}
+
+/**
+ * Write the durable stop request, then SIGTERM the owner `status` observed as
+ * running on this host, after a fresh generation check. The request stays for
+ * the daemon either way; `read` reports the state afterward.
+ */
+export function requestServiceStop<
+  S extends {
+    liveness: ServiceLiveness;
+    generation: ProcessGenerationVerdict;
+    record?: ServiceProcessOwner;
+  },
+>(
+  status: S,
+  read: () => S,
+  stopPath: string,
+  dependencies: ServiceProcessDependencies = {},
+  options: { signal?: boolean } = {},
+): S & ServiceStopFields {
+  writePrivateJsonAtomic(stopPath, {
+    requested_at: new Date().toISOString(),
+    requested_by_pid: process.pid,
+  });
+  const signal =
+    options.signal !== false && status.liveness === "running" && status.record?.host === hostname()
+      ? signalIfSameGeneration(
+          status.record.pid,
+          status.record.start_token,
+          "SIGTERM",
+          dependencies,
+        )
+      : { sent: false, verdict: status.generation };
+  return { ...read(), signal_sent: signal.sent, signal_verdict: signal.verdict };
+}

package/src/core/agents/state/stale-sweep.ts

@@ -10,21 +10,12 @@
  * `coord.freshness_seconds` (see `coordFreshnessSeconds`).
  */
 
-import { existsSync, lstatSync, readdirSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { existsSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
 import { coordFreshnessSeconds } from "../../config.ts";
 import { type EventAdapterIdV3, eventAdapterIdV3FromPlatform } from "../../events/v3/adapter-id.ts";
-import { withGenerationCustodyV3 } from "../../events/v3/generation-custody.ts";
-import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { writeProducerDiagnosticV3 } from "../../events/v3/producers/intake.ts";
 import { recordLiveSweepObservationV3 } from "../live-lifecycle-v3.ts";
-import {
-  captureFileRevision,
-  type DeleteFileResult,
-  deleteFileIfUnchanged,
-  type FileRecoveryResult,
-  recoverInterruptedFileDeletions,
-} from "./unchanged-file.ts";
 
 /** platform → adapter, for the swept-event envelope (mirrors heartbeat-writer's adapterOf). */
 /**
@@ -41,7 +32,6 @@ function emitSwept(
   instanceId: string,
   adapter: EventAdapterIdV3,
   sessionId: string,
-  expectedGenerationId: `gen_${string}` | null,
   reason: "stale" | "unparseable" | "missing_ts",
   ageSecs?: number,
 ): boolean {
@@ -51,7 +41,6 @@ function emitSwept(
       owner: instanceId,
       nativeSessionId: sessionId,
       adapter,
-      expectedGenerationId,
       observation:
         reason === "stale"
           ? "stale_heartbeat"
@@ -76,73 +65,13 @@ function emitSwept(
   }
 }
 
-/** Any retained or unreadable owner row prevents dependent cache deletion. */
-function retainsHeartbeat(
-  coordRoot: string,
-  activeDir: string,
-  owner: string,
-  uncertainOwners: Set<string>,
-): boolean {
-  if (uncertainOwners.has("*") || uncertainOwners.has(owner)) return true;
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(owner)) return true;
-  const heartbeat = join(activeDir, `${owner}.json`);
-  try {
-    lstatSync(heartbeat);
-    return true;
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") return true;
-  }
+/** File mtime in epoch-seconds, or +Infinity if it can't be read (treat as fresh → don't reap). */
+function mtimeSecs(path: string): number {
   try {
-    if (!lstatSync(activeDir).isDirectory()) return true;
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code !== "ENOENT";
-  }
-  // Callers hold this owner's custody. A sweeper that died after the initial
-  // directory scan may have left its heartbeat hidden under a private pin.
-  for (const recovery of recoverInterruptedFileDeletions(
-    activeDir,
-    (source) => source === heartbeat,
-  )) {
-    if (recovery.sourcePath && recovery.sourcePath !== heartbeat) continue;
-    if (recovery.state !== "restored") {
-      uncertainOwners.add(recovery.sourcePath ? owner : "*");
-      recordCleanupFailure(coordRoot, recovery.sourcePath ?? activeDir, recovery);
-    }
-    return true;
-  }
-  return false;
-}
-
-function recordCleanupFailure(
-  coordRoot: string,
-  sourcePath: string,
-  result: DeleteFileResult | FileRecoveryResult,
-): void {
-  if (
-    result.state !== "error" &&
-    result.state !== "recovery-required" &&
-    result.state !== "retained"
-  ) {
-    return;
+    return Math.floor(statSync(path).mtimeMs / 1000);
+  } catch {
+    return Number.POSITIVE_INFINITY;
   }
-  writeProducerDiagnosticV3(coordRoot, "heartbeat_sweep_unrecorded", {
-    signal: "cache.cleanup",
-    state: "cache_cleanup_pending",
-    reason: `${result.state}:${result.error ?? "file_cleanup_pending"}; source=${sourcePath}; recovery=${result.recoveryPath ?? "unavailable"}`,
-  });
-}
-
-function recordHeartbeatCleanupResult(
-  coordRoot: string,
-  sourcePath: string,
-  owner: string,
-  result: DeleteFileResult,
-  uncertainOwners: Set<string>,
-): void {
-  if (result.state === "recovery-required" || result.state === "error") {
-    uncertainOwners.add(owner);
-  }
-  recordCleanupFailure(coordRoot, sourcePath, result);
 }
 
 export function staleSweep(coordRoot: string): {
@@ -176,171 +105,98 @@ export function staleSweep(coordRoot: string): {
   // lifecycle.sweep_observed; a terminal or unavailable generation gets a
   // heartbeat_sweep_unrecorded producer diagnostic without being resurrected.
   const liveInstanceIds = new Set<string>();
-  const uncertainOwners = new Set<string>();
-  const d = resolve(coordRoot, ".harnery", "active");
-  for (const recovery of existsSync(d)
-    ? recoverInterruptedFileDeletions(
-        d,
-        (source) => dirname(source) === d && /^[A-Za-z0-9_-]{1,128}\.json$/.test(basename(source)),
-      )
-    : []) {
-    if (recovery.state !== "restored") {
-      uncertainOwners.add(recovery.sourcePath ? basename(recovery.sourcePath, ".json") : "*");
-      recordCleanupFailure(coordRoot, recovery.sourcePath ?? d, recovery);
-    }
-  }
+  const d = join(coordRoot, ".harnery", "active");
   if (existsSync(d)) {
     for (const f of readdirSync(d)) {
       if (!f.endsWith(".json")) continue;
       const path = join(d, f);
       const idFromFile = f.replace(/\.json$/, "");
-      if (!/^[A-Za-z0-9_-]{1,128}$/.test(idFromFile)) continue;
+      let parsed: {
+        instance_id?: string;
+        last_heartbeat?: string;
+        platform?: unknown;
+        session_id?: string;
+      } | null = null;
       try {
-        withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(idFromFile)], () => {
-          const revision = captureFileRevision(path);
-          if (!revision) return;
-          const mtimeSecs = Number(revision.mtimeNs / 1_000_000_000n);
-          let parsed: {
-            instance_id?: string;
-            last_heartbeat?: string;
-            platform?: unknown;
-            session_id?: string;
-            v3_generation_id?: unknown;
-          } | null = null;
-          try {
-            const value = JSON.parse(revision.bytes.toString("utf8"));
-            if (value && typeof value === "object" && !Array.isArray(value)) parsed = value;
-          } catch {
-            parsed = null;
-          }
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+      } catch {
+        parsed = null;
+      }
 
-          if (parsed === null) {
-            // Unparseable: only reap if the file itself is mtime-old.
-            if (mtimeSecs < cutoff) {
-              const result = deleteFileIfUnchanged(path, revision, () =>
-                emitSwept(
-                  coordRoot,
-                  idFromFile,
-                  "claude-code",
-                  idFromFile,
-                  null,
-                  "unparseable",
-                  nowSec - mtimeSecs,
-                ),
-              );
-              recordHeartbeatCleanupResult(coordRoot, path, idFromFile, result, uncertainOwners);
-              if (result.state === "deleted") {
-                heartbeatsRemoved.push(f);
-              }
+      if (parsed === null) {
+        // Unparseable: only reap if the file itself is mtime-old.
+        if (mtimeSecs(path) < cutoff) {
+          try {
+            const ageSecs = nowSec - mtimeSecs(path);
+            if (
+              !emitSwept(coordRoot, idFromFile, "claude-code", idFromFile, "unparseable", ageSecs)
+            ) {
+              continue;
             }
-            return;
+            unlinkSync(path);
+            heartbeatsRemoved.push(f);
+          } catch {
+            /* swallow */
           }
+        }
+        continue;
+      }
 
-          // The filename selects the writer's custody scope. A conflicting content
-          // identity cannot authorize an audit or deletion for a different owner.
-          if (parsed.instance_id !== undefined && parsed.instance_id !== idFromFile) return;
-          const instanceId = parsed.instance_id ?? idFromFile;
-          const adapter = eventAdapterIdV3FromPlatform(parsed.platform, { context: "stale-sweep" });
-          const sessionId = parsed.session_id ?? instanceId;
-          const generationId =
-            typeof parsed.v3_generation_id === "string" &&
-            /^gen_[A-Za-z0-9._-]+$/.test(parsed.v3_generation_id)
-              ? (parsed.v3_generation_id as `gen_${string}`)
-              : null;
-          const ts = parsed.last_heartbeat
-            ? Math.floor(Date.parse(parsed.last_heartbeat) / 1000)
-            : Number.NaN;
-
-          if (!parsed.last_heartbeat || !Number.isFinite(ts)) {
-            // No / NaN last_heartbeat: can't trust content; gate on mtime.
-            if (mtimeSecs < cutoff) {
-              const result = deleteFileIfUnchanged(path, revision, () =>
-                emitSwept(
-                  coordRoot,
-                  instanceId,
-                  adapter,
-                  sessionId,
-                  generationId,
-                  "missing_ts",
-                  nowSec - mtimeSecs,
-                ),
-              );
-              recordHeartbeatCleanupResult(coordRoot, path, idFromFile, result, uncertainOwners);
-              if (result.state === "deleted") {
-                heartbeatsRemoved.push(f);
-              }
-            } else if (parsed.instance_id) {
-              liveInstanceIds.add(parsed.instance_id);
-            }
-            return;
-          }
+      const instanceId = parsed.instance_id ?? idFromFile;
+      const adapter = eventAdapterIdV3FromPlatform(parsed.platform, { context: "stale-sweep" });
+      const sessionId = parsed.session_id ?? instanceId;
+      const ts = parsed.last_heartbeat
+        ? Math.floor(Date.parse(parsed.last_heartbeat) / 1000)
+        : Number.NaN;
 
-          if (ts < cutoff) {
-            // Legitimate stale prune (valid timestamp, past the freshness cutoff).
-            const result = deleteFileIfUnchanged(path, revision, () =>
-              emitSwept(
-                coordRoot,
-                instanceId,
-                adapter,
-                sessionId,
-                generationId,
-                "stale",
-                nowSec - ts,
-              ),
-            );
-            recordHeartbeatCleanupResult(coordRoot, path, idFromFile, result, uncertainOwners);
-            if (result.state === "deleted") {
-              heartbeatsRemoved.push(f);
-            }
-            return;
+      if (!parsed.last_heartbeat || !Number.isFinite(ts)) {
+        // No / NaN last_heartbeat: can't trust content; gate on mtime.
+        if (mtimeSecs(path) < cutoff) {
+          if (
+            !emitSwept(
+              coordRoot,
+              instanceId,
+              adapter,
+              sessionId,
+              "missing_ts",
+              nowSec - mtimeSecs(path),
+            )
+          ) {
+            continue;
           }
+          unlinkSync(path);
+          heartbeatsRemoved.push(f);
+        } else if (parsed.instance_id) {
+          liveInstanceIds.add(parsed.instance_id);
+        }
+        continue;
+      }
 
-          if (parsed.instance_id) liveInstanceIds.add(parsed.instance_id);
-        });
-      } catch {
-        // Busy or unknown custody retains the cache and its dependent files.
-        uncertainOwners.add(idFromFile);
+      if (ts < cutoff) {
+        // Legitimate stale prune (valid timestamp, past the freshness cutoff).
+        if (!emitSwept(coordRoot, instanceId, adapter, sessionId, "stale", nowSec - ts)) {
+          continue;
+        }
+        unlinkSync(path);
+        heartbeatsRemoved.push(f);
+        continue;
       }
+
+      if (parsed.instance_id) liveInstanceIds.add(parsed.instance_id);
     }
   }
 
   // 2. Prune pid-map entries whose instance has no live heartbeat.
-  const pidmapDir = resolve(coordRoot, ".harnery", "pid-map");
-  for (const recovery of existsSync(pidmapDir)
-    ? recoverInterruptedFileDeletions(
-        pidmapDir,
-        (source) => dirname(source) === pidmapDir && /^\d+$/.test(basename(source)),
-      )
-    : [])
-    recordCleanupFailure(coordRoot, recovery.sourcePath ?? pidmapDir, recovery);
+  const pidmapDir = join(coordRoot, ".harnery", "pid-map");
   if (existsSync(pidmapDir)) {
     for (const f of readdirSync(pidmapDir)) {
-      if (f.startsWith(".harnery-delete-")) continue;
       const path = join(pidmapDir, f);
       try {
-        const revision = captureFileRevision(path);
-        if (!revision) continue;
-        const row = revision.bytes.toString("utf8").trim();
+        const row = readFileSync(path, "utf8").trim();
         const ownerId = row.split("\t")[0]?.trim() ?? "";
-        const prune = () => {
-          if (
-            !ownerId ||
-            (!liveInstanceIds.has(ownerId) &&
-              !retainsHeartbeat(coordRoot, d, ownerId, uncertainOwners))
-          ) {
-            const result = deleteFileIfUnchanged(
-              path,
-              revision,
-              () => !ownerId || !retainsHeartbeat(coordRoot, d, ownerId, uncertainOwners),
-            );
-            recordCleanupFailure(coordRoot, path, result);
-            if (result.state === "deleted") pidmapsRemoved += 1;
-          }
-        };
-        if (/^[A-Za-z0-9_-]{1,128}$/.test(ownerId)) {
-          withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(ownerId)], prune);
-        } else if (!ownerId) {
-          prune();
+        if (!ownerId || !liveInstanceIds.has(ownerId)) {
+          unlinkSync(path);
+          pidmapsRemoved += 1;
         }
       } catch {
         /* swallow */
@@ -350,16 +206,7 @@ export function staleSweep(coordRoot: string): {
 
   // 3. Prune prompt hashes for dead owners. Resource hashes retain their own
   // count so existing peer-hash telemetry keeps its original meaning.
-  const agentsDir = resolve(coordRoot, ".harnery");
-  for (const recovery of existsSync(agentsDir)
-    ? recoverInterruptedFileDeletions(
-        agentsDir,
-        (source) =>
-          dirname(source) === agentsDir &&
-          /^\.last-(?:resource|peer)-hash\.[A-Za-z0-9_-]{1,128}$/.test(basename(source)),
-      )
-    : [])
-    recordCleanupFailure(coordRoot, recovery.sourcePath ?? agentsDir, recovery);
+  const agentsDir = join(coordRoot, ".harnery");
   if (existsSync(agentsDir)) {
     for (const f of readdirSync(agentsDir)) {
       const resourceHash = f.startsWith(".last-resource-hash.");
@@ -370,25 +217,13 @@ export function staleSweep(coordRoot: string): {
         // Ignore atomic-write temporary files and preserve hashes when a
         // retained heartbeat's liveness could not be determined safely.
         if (!/^[A-Za-z0-9_-]{1,128}$/.test(owner)) continue;
+        if (existsSync(join(d, `${owner}.json`))) continue;
       }
-      if (!liveInstanceIds.has(owner) && /^[A-Za-z0-9_-]{1,128}$/.test(owner)) {
+      if (!liveInstanceIds.has(owner)) {
         try {
-          withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(owner)], () => {
-            if (retainsHeartbeat(coordRoot, d, owner, uncertainOwners)) return;
-            const path = join(agentsDir, f);
-            const revision = captureFileRevision(path);
-            if (!revision) return;
-            const result = deleteFileIfUnchanged(
-              path,
-              revision,
-              () => !retainsHeartbeat(coordRoot, d, owner, uncertainOwners),
-            );
-            recordCleanupFailure(coordRoot, path, result);
-            if (result.state === "deleted") {
-              if (resourceHash) resourceHashesRemoved += 1;
-              else peerHashesRemoved += 1;
-            }
-          });
+          unlinkSync(join(agentsDir, f));
+          if (resourceHash) resourceHashesRemoved += 1;
+          else peerHashesRemoved += 1;
         } catch {
           /* swallow */
         }

package/src/core/artifacts/activity.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { lstatSync, readdirSync } from "node:fs";
+import { lstatSync, readdirSync, type Stats } from "node:fs";
 import { join } from "node:path";
 import { ARTIFACT_MANIFEST } from "./constants.ts";
 
@@ -36,11 +36,14 @@ export function artifactRootEntries(path: string): string {
  * Keep the prior root activity while its payload entries match the checkpoint.
  * A root deletion or rename changes that fingerprint; nested changes retain
  * their ordinary filesystem timestamps. Symlinks are inspected, never followed.
+ * `visit` sees every entry's lstat exactly once, including a root manifest the
+ * activity rules skip, so a caller can size the tree in the same walk.
  */
 export function readArtifactActivity(
   path: string,
   now: Date,
   previous?: ArtifactActivity,
+  visit?: (entry: string, stat: Stats) => void,
 ): ArtifactActivity {
   const entries = artifactRootEntries(path);
   const nowMs = now.getTime();
@@ -50,6 +53,7 @@ export function readArtifactActivity(
       : 0;
   const walk = (entry: string, root = false): number => {
     const stat = lstatSync(entry);
+    visit?.(entry, stat);
     let latest =
       root && previous?.root_entries_sha256 === entries
         ? accept(Date.parse(previous.last_changed_at))
@@ -58,7 +62,10 @@ export function readArtifactActivity(
       for (const name of readdirSync(entry)) {
         // Only this unit's own control manifest is metadata. Nested artifact
         // manifests are payload from the containing workspace's point of view.
-        if (root && previous && name === ARTIFACT_MANIFEST) continue;
+        if (root && previous && name === ARTIFACT_MANIFEST) {
+          if (visit) visit(join(entry, name), lstatSync(join(entry, name)));
+          continue;
+        }
         latest = Math.max(latest, walk(join(entry, name)));
       }
     }

package/src/core/artifacts/delivery-card.ts

@@ -14,7 +14,6 @@ import { isAbsolute, relative, resolve, sep } from "node:path";
 import { encodeLinkSafeComponent } from "../../lib/local-file-url.ts";
 import { findLiveTunnelForOrigin, tunnelServesPaths } from "../../lib/tunnel/state.ts";
 import { resolveWebPort } from "../config.ts";
-import { createTunnelReadinessVerifier } from "../servers/index.ts";
 import { stateFileMode } from "../storage/modes.ts";
 import { ARTIFACT_MANIFEST } from "./constants.ts";
 import { resolveArtifactRef, showArtifact } from "./index.ts";
@@ -331,12 +330,7 @@ function deliveryLinkBase(repoRoot: string, environment: DisplayEnvironment): st
   // route: its gate would refuse every link on the card.
   const tunnel =
     environment.tunnelUrl === undefined
-      ? findLiveTunnelForOrigin(
-          webPort,
-          `localhost:${webPort}`,
-          repoRoot,
-          createTunnelReadinessVerifier({ coordRoot: repoRoot }),
-        )
+      ? findLiveTunnelForOrigin(webPort, `localhost:${webPort}`, repoRoot)
       : null;
   const tunnelUrl =
     environment.tunnelUrl === undefined