@akagilnc/pi-workflow-roles 0.1.2497 → 0.1.2510

package/README.md

@@ -47,7 +47,7 @@ ak-role config set-auto-resume-limit 3
 
 `config set` stores the seat model default. For Gate officers (`gatekeeper` / `inspector` / `notary`) resolution is officer pin → province (`gatekeeper`) pin → inherit parent session; an explicit selection that fails is loud and does not fall back. `config unset` clears only those officer overrides. `config set-engine` / `unset-engine` store or clear the persistent labor-engine name on callable roles (same seats as `--engine`; navigator refused — no independent activation). `config set-auto-resume-limit` stores the single-call auto-resume ceiling. Usage and refusal text are owned by `ak-role config` / `ak-role help config`.
 
-Receipts are typed, so callers compose roles without parsing prose; ordering and stopping stay caller-owned. Programmatic consumers derive contracts from the exported schemas in `src/package-contracts/`, not from this guide.
+Receipts are typed, so callers compose roles without parsing prose; ordering and stopping stay caller-owned. Province-grade (省部级) seats may dispatch proper role calls within their own single invocation, but the public CLI semantics are unchanged — an external caller still launches one chosen role per invocation and retains ordering, repetition, and stopping across CLI calls (ADR 0010 two-grade amendment). Programmatic consumers derive contracts from the exported schemas in `src/package-contracts/`, not from this guide.
 
 ### Gate submission gate
 

package/README.zh-CN.md

@@ -47,7 +47,7 @@ ak-role config set-auto-resume-limit 3
 
 `config set` 存席位模型默认。门下省官席（`gatekeeper`／`inspector`／`notary`）解析顺序：官自钉 → 省钉（`gatekeeper`）→ 继承父 session；显式指定失败响亮、不回退。`config unset` 只清这三官的覆盖。`config set-engine`／`unset-engine` 在可调用角色上写入或清除持久劳务引擎名（与 `--engine` 同轴；拒收 navigator——无独立 activation）。`config set-auto-resume-limit` 写入单次调用自动续跑上限。用法与拒绝文案以 `ak-role config`／`ak-role help config` 为准。
 
-回执是 typed 的，调用者不必解析散文即可组合角色；顺序与停止归调用者。编程消费者从 `src/package-contracts/` 导出推导契约，不从本文。
+回执是 typed 的，调用者不必解析散文即可组合角色；顺序与停止归调用者。省部级（province-grade）角色可在自己单次调用的内政之内派发正经角色调用，但公开 CLI 语义零变化——外部调用者仍一次启动其选中的一个角色，跨 CLI 调用的顺序、重复与停止仍全归外部调用者（ADR 0010 两品级窄修）。编程消费者从 `src/package-contracts/` 导出推导契约，不从本文。
 
 ### 门下省交卷闸
 
@@ -133,13 +133,14 @@ ak-role resume <runId> "<裁定>"
 | analyst | **太史** | 司天台分析席：只读司天记录、出高阶指标；确定性机制，非 LLM，可单独调用 | 已建（[ADR 0068](docs/adr/0068-taishi-analysis-seat-reads-records-writes-sibling-home.md)；机器面键 `analyst`，[#445](https://github.com/Akagilnc/ak-pi-workflow-roles/issues/445) 拼音清零） |
 | — | **司天台** | 记候簿——只打点、只指针，不分析不执法 | **一期不是角色**（[ADR 0047](docs/adr/0047-sitian-phase-one-mechanism-not-role.md)：零 LLM 双面对账）；分析席已由太史承担；机器面键 `archivist`（[#445](https://github.com/Akagilnc/ak-pi-workflow-roles/issues/445)） |
 | gleaner-left | **左拾遗** | 合并前以无锚定冷眼审全幅合并候选，只上弹章、不封驳不裁决（风闻） | soul 已落＋[ADR 0067](docs/adr/0067-menxia-province-founding-jishizhong-fubaolang.md) 修正案；机器席位待建 |
+| marshal | **尚书省** | 审→判→修 质量收敛环的省部级驱动角色：调用方递票号与 baseline，尚书省驱动御史台/大理寺/修内司滚到收敛（converged 唯庭可判）或 escalate 上呈，交回 typed 报告；不弹、不判、不修，只让链条转到收敛 | 已定名（#145）；席位待落地（#146） |
 | — | **兰台** | 读档议制——耗时／缺口／冗余三条，上奏不执法 | 未建 |
 | — | **考功司** | 考具体效率——角色与档位的升档率、一次通过率、每票成本 | 留档，需要时另立票 |
 | — | **主簿** | 合并后勾稽销案：核实确已合上、清理残留、报到达 | 未建 |
 
 **merge 按钮归调用者**，没有任何角色握不可逆权限：通进司把收证这件苦活做完并报收集终态，人（或 AI）自己判断、自己点，点完想调主簿就调、不调也可以。
 
-上表**不规定调用顺序**——组合、顺序、重复次数归调用者（[ADR 0010](docs/adr/0010-callers-own-role-composition-and-repetition.md)）。御史台／大理寺／审刑院是**职责分立的类比，不是必经链**；审刑院也并非只跟在大理寺之后，大理寺、御史台、太医署各自都有一次。门下省交卷闸是完成侧挂钩，不是调用者必经编排链。
+上表**不规定调用顺序**——组合、顺序、重复次数归调用者（[ADR 0010](docs/adr/0010-callers-own-role-composition-and-repetition.md)）。御史台／大理寺／审刑院是**职责分立的类比，不是必经链**；审刑院也并非只跟在大理寺之后，大理寺、御史台、太医署各自都有一次。门下省交卷闸是完成侧挂钩，不是调用者必经编排链。省部级角色的内部组合属于其单次调用的内政，公开 CLI 语义零变化——外部调用者仍一次启动其选中的一个角色，跨 CLI 调用的顺序、重复与停止仍全归外部调用者。
 
 `拾遗补阙` 成对留档，待将来出现第二个进言席再启用。
 

package/dist/public-cli/main.js

@@ -16031,55 +16031,128 @@ function describeErrorIdentity(error) {
   const message = typeof candidate?.message === "string" && candidate.message !== "" ? `: ${candidate.message}` : "";
   return `${name}${code}${message}`;
 }
+function errorCodeOf(error) {
+  return error.code;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCodeOf(error) !== "ESRCH";
+  }
+}
+async function autopsyWriterLock(lockPath) {
+  let content;
+  try {
+    content = await readFile5(lockPath, "utf8");
+  } catch (error) {
+    if (errorCodeOf(error) === "ENOENT") return { verdict: "absent" };
+    return { verdict: "absent", readFailure: error };
+  }
+  const pid = Number.parseInt(content.trim(), 10);
+  if (!Number.isInteger(pid) || pid <= 0) return { verdict: "absent" };
+  return isProcessAlive(pid) ? { verdict: "alive", pid } : { verdict: "dead", pid };
+}
+function describeAutopsy(autopsy) {
+  switch (autopsy.verdict) {
+    case "alive":
+      return `live pid ${autopsy.pid}`;
+    case "dead":
+      return `dead pid ${autopsy.pid}`;
+    case "absent":
+      return autopsy.readFailure !== void 0 ? "unreadable lock" : "absent or unparseable holder";
+  }
+}
+async function reclaimStaleWriterLock(lockPath, runDirectory) {
+  const current = await autopsyWriterLock(lockPath);
+  if (current.verdict !== "dead") return;
+  try {
+    await unlink2(lockPath);
+  } catch (error) {
+    if (errorCodeOf(error) === "ENOENT") return;
+    if (errorCodeOf(error) !== "EACCES") throw error;
+    await chmod(runDirectory, 493);
+    await unlink2(lockPath);
+  }
+}
+async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
+  const handle = await open(lockPath, "wx");
+  try {
+    await handle.writeFile(`${process.pid}
+`, "utf8");
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    await unlink2(lockPath).catch(() => void 0);
+    throw error;
+  }
+  let released = false;
+  return {
+    lockPath,
+    async release() {
+      if (released) return;
+      released = true;
+      await handle.close().catch(() => void 0);
+      try {
+        await unlink2(lockPath);
+      } catch (error) {
+        if (errorCodeOf(error) === "EACCES") {
+          try {
+            await chmod(runDirectory, 493);
+            await unlink2(lockPath);
+          } catch (retryError) {
+            reportCleanupFailure(retryError);
+          }
+        } else {
+          reportCleanupFailure(error);
+        }
+      }
+    }
+  };
+}
 async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
   const reportCleanupFailure = (error) => {
     try {
       onCleanupFailure?.(
-        `writer lease lock cleanup failed (best-effort continue; stale lock resurfaces as lease-held on next acquire) at ${join7(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+        `writer lease lock cleanup failed (best-effort continue; stale lock is reclaimed by the next acquire's holder autopsy) at ${join7(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
       );
     } catch {
     }
   };
   const lockPath = join7(runDirectory, WRITER_LOCK_FILE);
-  try {
-    const handle = await open(lockPath, "wx");
+  let lastAutopsy = { verdict: "absent" };
+  for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
     try {
-      await handle.writeFile(`${process.pid}
-`, "utf8");
+      return await createWriterLease(lockPath, runDirectory, reportCleanupFailure);
     } catch (error) {
-      await handle.close().catch(() => void 0);
-      await unlink2(lockPath).catch(() => void 0);
-      throw error;
+      if (errorCodeOf(error) !== "EEXIST") throw error;
     }
-    let released = false;
-    return {
-      lockPath,
-      async release() {
-        if (released) return;
-        released = true;
-        await handle.close().catch(() => void 0);
-        try {
-          await unlink2(lockPath);
-        } catch (error) {
-          if (error.code === "EACCES") {
-            try {
-              await chmod(runDirectory, 493);
-              await unlink2(lockPath);
-            } catch (retryError) {
-              reportCleanupFailure(retryError);
-            }
-          } else {
-            reportCleanupFailure(error);
-          }
-        }
-      }
-    };
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
-      throw new RunWriterLeaseHeldError();
+    lastAutopsy = await autopsyWriterLock(lockPath);
+    if (lastAutopsy.verdict === "absent" && lastAutopsy.readFailure !== void 0) {
+      reportCleanupFailure(lastAutopsy.readFailure);
+    }
+    if (lastAutopsy.verdict === "alive") {
+      throw new RunWriterLeaseHeldError(
+        `role run writer lease is already held by live pid ${lastAutopsy.pid} at ${lockPath}`
+      );
+    }
+    if (lastAutopsy.verdict === "absent") {
+      throw new RunWriterLeaseHeldError(
+        lastAutopsy.readFailure !== void 0 ? `role run writer lease lock is unreadable at ${lockPath}: ${describeErrorIdentity(lastAutopsy.readFailure)}; holder liveness unverifiable, lock left in place` : `role run writer lease lock at ${lockPath} has no verifiable holder pid (empty or unparseable); holder liveness unverifiable, lock left in place`
+      );
+    }
+    if (reclaimsLeft <= 0) break;
+    try {
+      await reclaimStaleWriterLock(lockPath, runDirectory);
+    } catch (reclaimError) {
+      throw new RunWriterLeaseHeldError(
+        `stale writer lease reclaim failed at ${lockPath} (autopsy: ${describeAutopsy(lastAutopsy)}): ${describeErrorIdentity(reclaimError)}`
+      );
     }
-    throw error;
   }
+  throw new RunWriterLeaseHeldError(
+    `role run writer lease stayed contested at ${lockPath} after ${WRITER_LEASE_RECLAIM_ROUNDS} reclaims (last autopsy: ${describeAutopsy(lastAutopsy)})`
+  );
 }
 async function findRunDirectoryById(home, runId) {
   if (runId.trim() === "") return void 0;
@@ -16471,7 +16544,7 @@ async function peekRoleRunRole(home, runId) {
   const run = await readRoleRunState(runDirectory);
   return run?.role;
 }
-var V1_RESUMABLE_PROVIDERS, AUTO_RESUME_LIMIT, RESUME_TRANSPORT_ENVELOPE, RUN_STATE_FILE, WRITER_LOCK_FILE, RunWriterLeaseHeldError;
+var V1_RESUMABLE_PROVIDERS, AUTO_RESUME_LIMIT, RESUME_TRANSPORT_ENVELOPE, RUN_STATE_FILE, WRITER_LOCK_FILE, RunWriterLeaseHeldError, WRITER_LEASE_RECLAIM_ROUNDS;
 var init_run_lifecycle = __esm({
   "src/public-cli/run-lifecycle.ts"() {
     "use strict";
@@ -16492,6 +16565,7 @@ var init_run_lifecycle = __esm({
         this.name = "RunWriterLeaseHeldError";
       }
     };
+    WRITER_LEASE_RECLAIM_ROUNDS = 3;
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2497",
+  "version": "0.1.2510",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/factory-board.ts

@@ -194,7 +194,7 @@ function placeTicket(prepared: PreparedTicket): BoardPlacement {
   }
   if (latest.station === "coder") return "coder";
   if (latest.station === "fixer" || latest.station === "reviewer") return "marshal";
-  // ADR 0053: marshal-driven runs land in 刑部 once the seat ships (station maps now).
+  // ADR 0053: marshal-driven runs land in 尚书省 once the seat ships (station maps now).
   if (latest.station === "marshal") return "marshal";
   if (latest.station === "collector") return "collector";
   return `other:${latest.station}`;
@@ -399,7 +399,7 @@ const YAMEN_LABELS: Readonly<Record<string, string>> = {
   collector: "通进司",
   doctor: "太医署",
   merger: "校书郎",
-  marshal: "刑部",
+  marshal: "尚书省",
 };
 
 function latestKnownStation(runs: readonly TicketTrajectoryRun[]): string | undefined {
@@ -805,7 +805,7 @@ const COLUMN_LABELS: Readonly<Record<string, string>> = {
   pending: "待发",
   court: "大理寺 · 审票",
   coder: "将作监",
-  marshal: "刑部",
+  marshal: "尚书省",
   collector: "通进司",
   done: "已完成",
 };

package/src/public-cli/run-lifecycle.ts

@@ -382,14 +382,151 @@ export function describeErrorIdentity(error: unknown): string {
   return `${name}${code}${message}`;
 }
 
+function errorCodeOf(error: unknown): unknown {
+  return (error as { code?: unknown }).code;
+}
+
+/**
+ * Signal-0 liveness probe. Only ESRCH proves absence; any other refusal
+ * (e.g. EPERM) means the holder process exists.
+ */
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return errorCodeOf(error) !== "ESRCH";
+  }
+}
+
+type WriterLockAutopsy =
+  | { verdict: "absent"; readFailure?: unknown }
+  | { verdict: "dead"; pid: number }
+  | { verdict: "alive"; pid: number };
+
+/**
+ * Holder autopsy for an existing writer.lock (#552). "absent" covers no file,
+ * no parseable pid (a live creator mid-acquisition reads as empty, and so does
+ * the crash-window leftover), and unreadable files — absent alone never
+ * authorizes reclaim; only a "dead" verdict does. A non-ENOENT read failure
+ * still decides "absent" but rides along as readFailure so the true cause can
+ * land in the cleanup sink instead of being laundered away.
+ */
+async function autopsyWriterLock(lockPath: string): Promise<WriterLockAutopsy> {
+  let content: string;
+  try {
+    content = await readFile(lockPath, "utf8");
+  } catch (error) {
+    if (errorCodeOf(error) === "ENOENT") return { verdict: "absent" };
+    return { verdict: "absent", readFailure: error };
+  }
+  const pid = Number.parseInt(content.trim(), 10);
+  if (!Number.isInteger(pid) || pid <= 0) return { verdict: "absent" };
+  return isProcessAlive(pid) ? { verdict: "alive", pid } : { verdict: "dead", pid };
+}
+
+function describeAutopsy(autopsy: WriterLockAutopsy): string {
+  switch (autopsy.verdict) {
+    case "alive":
+      return `live pid ${autopsy.pid}`;
+    case "dead":
+      return `dead pid ${autopsy.pid}`;
+    case "absent":
+      return autopsy.readFailure !== undefined
+        ? "unreadable lock"
+        : "absent or unparseable holder";
+  }
+}
+
 /**
- * Acquire the one-writer lease for a Role run. Concurrent acquire rejects
- * without dispatch. Exclusive create — no second writer.
+ * Remove one lock whose re-read autopsy is still a verified-dead holder, or
+ * leave it for the next round otherwise. The pre-unlink re-read guard means a
+ * concurrent writer that re-locked between the autopsy and the unlink cannot
+ * have its live lock stolen. Residual race: a writer can still re-lock between
+ * the re-read and the unlink itself; POSIX offers no compare-and-delete, and
+ * this narrows the window to a single syscall pair.
+ */
+async function reclaimStaleWriterLock(lockPath: string, runDirectory: string): Promise<void> {
+  const current = await autopsyWriterLock(lockPath);
+  if (current.verdict !== "dead") return;
+  try {
+    await unlink(lockPath);
+  } catch (error) {
+    if (errorCodeOf(error) === "ENOENT") return;
+    if (errorCodeOf(error) !== "EACCES") throw error;
+    await chmod(runDirectory, 0o755);
+    await unlink(lockPath);
+  }
+}
+
+async function createWriterLease(
+  lockPath: string,
+  runDirectory: string,
+  reportCleanupFailure: (error: unknown) => void,
+): Promise<RunWriterLease> {
+  const handle = await open(lockPath, "wx");
+  try {
+    await handle.writeFile(`${process.pid}\n`, "utf8");
+  } catch (error) {
+    await handle.close().catch(() => undefined);
+    await unlink(lockPath).catch(() => undefined);
+    throw error;
+  }
+  let released = false;
+  return {
+    lockPath,
+    async release() {
+      if (released) return;
+      released = true;
+      await handle.close().catch(() => undefined);
+      try {
+        await unlink(lockPath);
+      } catch (error) {
+        if (errorCodeOf(error) === "EACCES") {
+          try {
+            await chmod(runDirectory, 0o755);
+            await unlink(lockPath);
+          } catch (retryError) {
+            // best-effort cleanup: a stale lock left here is reclaimed by the
+            // next acquire's holder autopsy, but the true chmod/unlink cause
+            // must be recorded, not swallowed.
+            reportCleanupFailure(retryError);
+          }
+        } else {
+          // non-EACCES unlink failure is best-effort settlement cleanup; record true cause.
+          reportCleanupFailure(error);
+        }
+      }
+    },
+  };
+}
+
+const WRITER_LEASE_RECLAIM_ROUNDS = 3;
+
+/**
+ * Acquire the one-writer lease for a Role run. Exclusive create — no second
+ * writer; a concurrent acquire rejects without dispatch.
+ *
+ * A contested lock gets a holder autopsy before rejection (#552): only a
+ * verified-dead holder pid — parseable pid, signal-0 ESRCH, and still dead on
+ * the pre-unlink re-read — authorizes reclaim, because no writer is left to
+ * release the lock; acquire then retries the create. An empty, unparseable, or
+ * unreadable lock proves no dead holder (a live creator is mid-acquisition
+ * between the exclusive create and its pid write), so it rejects as
+ * RunWriterLeaseHeldError naming the path and the lock stays on disk — a
+ * crash-window empty lock blocking a resume is that refusal's known residue,
+ * not safely fixable by unlink here. A live holder rejects the same typed
+ * error naming the pid and path. A pid recycled by an unrelated process reads
+ * as alive — that degrades to the same typed rejection, never worse than the
+ * pre-#552 behavior. Reclaim rounds are bounded by
+ * WRITER_LEASE_RECLAIM_ROUNDS; a lock that stays contested (e.g. a reclaim
+ * race repeatedly lost) surfaces the same typed error instead of spinning.
  *
  * `onCleanupFailure` receives a non-terminal diagnostic line when release-time
- * lock cleanup fails. Release stays best-effort (a stale lock resurfaces as
- * RunWriterLeaseHeldError on next acquire), but the true error identity must
- * still land somewhere observable — silent swallowing is forbidden.
+ * lock cleanup fails or a contested lock cannot be read. Release stays
+ * best-effort (a stale lock is reclaimed by the next acquire's autopsy), but
+ * the true error identity must still land somewhere observable — silent
+ * swallowing is forbidden.
  */
 export async function acquireRunWriterLease(
   runDirectory: string,
@@ -401,58 +538,57 @@ export async function acquireRunWriterLease(
     // cause has already been handed to the sink as its argument.
     try {
       onCleanupFailure?.(
-        `writer lease lock cleanup failed (best-effort continue; stale lock resurfaces as lease-held on next acquire) at ${join(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`,
+        `writer lease lock cleanup failed (best-effort continue; stale lock is reclaimed by the next acquire's holder autopsy) at ${join(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`,
       );
     } catch {
       // diagnostic-sink failure is itself best-effort; never break release().
     }
   };
   const lockPath = join(runDirectory, WRITER_LOCK_FILE);
-  try {
-    const handle = await open(lockPath, "wx");
+  let lastAutopsy: WriterLockAutopsy = { verdict: "absent" };
+  // The reclaim budget: every successful reclaim is immediately followed by a
+  // fresh create attempt, including the budget's last one (the previous shape
+  // exited after a final-round reclaim with the path already clear).
+  for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
     try {
-      await handle.writeFile(`${process.pid}\n`, "utf8");
+      return await createWriterLease(lockPath, runDirectory, reportCleanupFailure);
     } catch (error) {
-      await handle.close().catch(() => undefined);
-      await unlink(lockPath).catch(() => undefined);
-      throw error;
+      if (errorCodeOf(error) !== "EEXIST") throw error;
     }
-    let released = false;
-    return {
-      lockPath,
-      async release() {
-        if (released) return;
-        released = true;
-        await handle.close().catch(() => undefined);
-        try {
-          await unlink(lockPath);
-        } catch (error) {
-          if ((error as { code?: unknown }).code === "EACCES") {
-            try {
-              await chmod(runDirectory, 0o755);
-              await unlink(lockPath);
-            } catch (retryError) {
-              // best-effort cleanup: stale lock will surface as lease-held on next acquire (exit 2),
-              // but the true chmod/unlink cause must be recorded, not swallowed.
-              reportCleanupFailure(retryError);
-            }
-          } else {
-            // non-EACCES unlink failure is best-effort settlement cleanup; record true cause.
-            reportCleanupFailure(error);
-          }
-        }
-      },
-    };
-  } catch (error) {
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error as { code?: unknown }).code === "EEXIST"
-    ) {
-      throw new RunWriterLeaseHeldError();
+    lastAutopsy = await autopsyWriterLock(lockPath);
+    if (lastAutopsy.verdict === "absent" && lastAutopsy.readFailure !== undefined) {
+      // 失败诚实: a lock we could not read must land its true read cause
+      // somewhere observable — recorded, but never treated as proof of death.
+      reportCleanupFailure(lastAutopsy.readFailure);
+    }
+    if (lastAutopsy.verdict === "alive") {
+      throw new RunWriterLeaseHeldError(
+        `role run writer lease is already held by live pid ${lastAutopsy.pid} at ${lockPath}`,
+      );
+    }
+    if (lastAutopsy.verdict === "absent") {
+      // #552 mechanical criterion: stale = holder pid verified dead. An
+      // empty lock (a live creator is mid-acquisition before its pid write)
+      // or an unreadable one proves no dead holder — unlinking here could
+      // steal a live writer's lock, so reject typed and leave the lock.
+      throw new RunWriterLeaseHeldError(
+        lastAutopsy.readFailure !== undefined
+          ? `role run writer lease lock is unreadable at ${lockPath}: ${describeErrorIdentity(lastAutopsy.readFailure)}; holder liveness unverifiable, lock left in place`
+          : `role run writer lease lock at ${lockPath} has no verifiable holder pid (empty or unparseable); holder liveness unverifiable, lock left in place`,
+      );
+    }
+    if (reclaimsLeft <= 0) break;
+    try {
+      await reclaimStaleWriterLock(lockPath, runDirectory);
+    } catch (reclaimError) {
+      throw new RunWriterLeaseHeldError(
+        `stale writer lease reclaim failed at ${lockPath} (autopsy: ${describeAutopsy(lastAutopsy)}): ${describeErrorIdentity(reclaimError)}`,
+      );
     }
-    throw error;
   }
+  throw new RunWriterLeaseHeldError(
+    `role run writer lease stayed contested at ${lockPath} after ${WRITER_LEASE_RECLAIM_ROUNDS} reclaims (last autopsy: ${describeAutopsy(lastAutopsy)})`,
+  );
 }
 
 /**