Do you understand why this keeps getting marked as changed?

I think it's the timestamp on the files changing; I haven't yet figured out a way to ignore this.

Thinking out loud, is it possible that a daemon reports an error, but after that, the last seen isn't updated. Then after stale interval the error disappears, and perhaps nobody ever notices it?

Also, don't we want to apply the same rules tor.ProvisionerDaemons?

is it possible that a daemon reports an error, but after that, the last seen isn't updated. Then after stale interval the error disappears, and perhaps nobody ever notices it?

Yes, and this is by design. If a provisioner daemon connects at some point, has a transient error, and then never heartbeats, I don't think it makes sense to warn about this.

That's fair. I was entertaining the possibility of some error state resulting in the provisioner exiting, crashing or plain stopping communication with server. But I didn't have anything concrete in mind, so this is fine.

This feels more likeConfig instead ofDeps, but I'll leave it up to you.