chainlesschain 0.164.0 → 0.165.2

package/src/lib/sub-agent-context.js

@@ -31,6 +31,27 @@ const SUMMARY_DIRECT_THRESHOLD = 500; // chars — below this, use result as-is
 const SUMMARY_SECTION_PATTERN =
   /^##\s*(Summary|Result|Output|Conclusion|Answer)/im;
 const TRUNCATE_LENGTH = 500;
+const PROVIDER_CLIENT_REQUEST_ID_RE = /^ccwf_[a-f0-9]{64}$/;
+const PROVIDER_CALL_ID_RE = /^[A-Za-z0-9._:-]{1,256}$/;
+const PROVIDER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const WORKFLOW_EFFECT_ID_RE = /^sha256:[a-f0-9]{64}$/;
+const WORKFLOW_CHILD_EFFECT_PROTOCOL = "cc-workflow-child-effect/v1";
+const WORKFLOW_TOOL_CALL_ID_RE = /^[\x21-\x7e]{1,512}$/;
+const WORKFLOW_TOOL_NAME_RE = /^[A-Za-z0-9._:-]{1,256}$/;
+
+function ownDataValue(value, property) {
+  if (!value || (typeof value !== "object" && typeof value !== "function")) {
+    return undefined;
+  }
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, property);
+    return descriptor && Object.hasOwn(descriptor, "value")
+      ? descriptor.value
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
 
 function runtimeUsageObserverFailure(error, code, message) {
   const failure =
@@ -132,6 +153,8 @@ export class SubAgentContext {
    * @param {boolean} [options.memoryEnabled=true] - When false, the child's
    *   context engine suppresses hierarchical-memory recall (contract memory:false)
    * @param {object} [options.llmOptions] - LLM provider/model/key options
+   * @param {string} [options.workflowEffectId] - Durable workflow effect bound
+   *   to provider request identities for this child run
    * @param {string} [options.cwd] - Working directory
    * @param {boolean} [options.useWorktree] - Force worktree isolation (overrides flag)
    * @param {function} [options.onUsageBoundary] - Synchronous observer for
@@ -207,6 +230,11 @@ export class SubAgentContext {
     this._runId = null;
     this._checkpointIds = [];
     this._toolUseIds = [];
+    this._workflowEffectId = options.workflowEffectId ?? null;
+    this._providerRequestAttempts = [];
+    this._providerRequestReceipts = [];
+    this._nestedEffectAttempts = [];
+    this._nestedEffectSettlements = [];
 
     // ── Isolated state ──────────────────────────────────────────────
     // Independent message history — never shared with parent
@@ -547,7 +575,9 @@ export class SubAgentContext {
       }
       return result;
     } catch (err) {
-      if (err?.runtimeLedgerPersistence === true) throw err;
+      if (err?.runtimeLedgerPersistence === true || this._workflowEffectId) {
+        throw err;
+      }
       // If worktree creation fails (e.g. not a git repo), fall back to direct
       this.status = "failed";
       this.completedAt = new Date().toISOString();
@@ -615,6 +645,17 @@ export class SubAgentContext {
     }
     options.toolAdmission = this.toolAdmission;
     options.skillAllowlist = this.skillAllowlist;
+    // A caller cannot replace the durable outer effect through loopOptions.
+    // agentLoop validates the canonical sha256 form before any provider call.
+    if (this._workflowEffectId) {
+      options.workflowEffectId = this._workflowEffectId;
+      options.onProviderRequestBoundary = (event) => {
+        this._recordProviderRequestAttempt(event);
+      };
+    } else {
+      delete options.workflowEffectId;
+      delete options.onProviderRequestBoundary;
+    }
     const authority = this._parentAuthority;
     if (authority.permissionRules) {
       options.permissionRules = authority.permissionRules;
@@ -651,6 +692,22 @@ export class SubAgentContext {
     let observeUsageSettlement = null;
     let observeToolBoundary = null;
     let observeToolSettlement = null;
+    const providerReceiptForSettlement = (event) => {
+      for (
+        let index = this._providerRequestReceipts.length - 1;
+        index >= 0;
+        index -= 1
+      ) {
+        const receipt = this._providerRequestReceipts[index];
+        if (
+          receipt.callId === event?.callId &&
+          (!event?.provider || receipt.provider === event.provider)
+        ) {
+          return { ...receipt };
+        }
+      }
+      return null;
+    };
     if (strictUsageTelemetry) {
       // Presence is checked without invoking either observer. In particular,
       // do not manufacture a null "validation event" that a durable writer
@@ -805,11 +862,29 @@ export class SubAgentContext {
           }
         }
         if (event.type === "tool-executing" && event.tool_use_id) {
+          this._recordNestedEffectAttempt(event);
           const toolUseId = String(event.tool_use_id);
           if (!this._toolUseIds.includes(toolUseId)) {
             this._toolUseIds.push(toolUseId);
           }
         }
+        if (event.type === "provider-request-receipt") {
+          this._providerRequestReceipts.push(
+            Object.freeze({
+              protocol: event.protocol,
+              provider: event.provider,
+              workflowEffectId: event.workflowEffectId,
+              callId: event.callId,
+              callSequence: event.callSequence,
+              source: event.source,
+              clientRequestId: event.clientRequestId,
+              requestId: event.requestId || null,
+              responseId: event.responseId || null,
+              requestIdentitySemantics: event.requestIdentitySemantics,
+              independentlyReadable: event.independentlyReadable,
+            }),
+          );
+        }
 
         if (event.type === "token-usage") {
           const forwardedUsage = {
@@ -819,6 +894,7 @@ export class SubAgentContext {
             model: event.model || null,
             usage: event.usage || null,
             ...(event.source ? { source: event.source } : {}),
+            providerReceipt: providerReceiptForSettlement(event),
             attribution: event.attribution || null,
             ...(event.boundaryNotified === true ||
             event.ledgerPersisted === true
@@ -865,6 +941,9 @@ export class SubAgentContext {
         }
 
         if (event.type === "model-usage-started") {
+          if (event.providerRequestId) {
+            this._recordProviderRequestAttempt(event);
+          }
           if (strictUsageTelemetry) {
             if (
               event.boundaryNotified === true ||
@@ -896,6 +975,7 @@ export class SubAgentContext {
                 ? "semantic-compaction"
                 : "model"),
             code: event.code || "provider_transport_outcome_unknown",
+            providerReceipt: providerReceiptForSettlement(event),
             attribution: event.attribution || null,
             ...(event.boundaryNotified === true ||
             event.ledgerPersisted === true
@@ -932,9 +1012,26 @@ export class SubAgentContext {
         }
 
         if (event.type === "tool-result") {
+          const nestedEffectSettlement =
+            this._recordNestedEffectSettlement(event);
           if (strictUsageTelemetry && event.tool_use_id) {
             observeToolSettlement(event);
           }
+          // A consumer may stop the async generator after this yielded result
+          // because of cancellation or a local token budget. Fence the unknown
+          // here, after the strict settlement observer closes its boundary, so
+          // generator.return() cannot suppress the outer reconciliation signal.
+          if (nestedEffectSettlement?.outcomeUnknown === true) {
+            const error = new Error(
+              `Workflow-bound nested tool ${nestedEffectSettlement.tool} has an unknown outcome and requires reconciliation`,
+            );
+            error.code = "CC_WORKFLOW_NESTED_TOOL_OUTCOME_UNKNOWN";
+            error.workflowEffectOutcomeUnknown = true;
+            error.workflowEffectId = nestedEffectSettlement.workflowEffectId;
+            error.workflowChildEffectId =
+              nestedEffectSettlement.childEffectId;
+            throw error;
+          }
           // Store large tool results as artifacts
           const resultStr = JSON.stringify(event.result);
           // Estimate token count from tool result (~4 chars per token)
@@ -1004,8 +1101,22 @@ export class SubAgentContext {
           "Strict child execution ended with an unsettled provider or tool call",
         );
       }
+      if (
+        this._workflowEffectId &&
+        this._nestedEffectAttempts.length !==
+          this._nestedEffectSettlements.length
+      ) {
+        const error = new Error(
+          "Workflow-bound child execution ended with an unsettled nested effect",
+        );
+        error.code = "CC_WORKFLOW_CHILD_EFFECT_SETTLEMENT_INCOMPLETE";
+        error.workflowEffectOutcomeUnknown = true;
+        throw error;
+      }
     } catch (err) {
-      if (err?.runtimeLedgerPersistence === true) throw err;
+      if (err?.runtimeLedgerPersistence === true || this._workflowEffectId) {
+        throw err;
+      }
       if (this.isAborted()) {
         this.forceComplete(this._cancelReason || "cancelled", {
           partialContent: lastContent,
@@ -1159,11 +1270,166 @@ export class SubAgentContext {
       parentTraceId: this._hookParentTraceId || null,
       checkpointIds: [...this._checkpointIds],
       toolUseIds: [...this._toolUseIds],
+      ...(this._workflowEffectId
+        ? {
+            providerRequestAttempts: this.providerRequestAttempts(),
+            providerRequestReceipts: this.providerRequestReceipts(),
+            nestedEffectAttempts: this.nestedEffectAttempts(),
+            nestedEffectSettlements: this.nestedEffectSettlements(),
+          }
+        : {}),
       worktreeId: worktree?.branch || this._worktreeBranch || null,
       worktreePath: worktree?.path || this._worktreePath || null,
     };
   }
 
+  /**
+   * Effect-bound provider calls admitted before transport dispatch.
+   */
+  providerRequestAttempts() {
+    return this._providerRequestAttempts.map((attempt) => ({ ...attempt }));
+  }
+
+  /**
+   * Provider-returned request identifiers observed during this child run.
+   * Values are copied so callers cannot mutate recovery evidence in place.
+   */
+  providerRequestReceipts() {
+    return this._providerRequestReceipts.map((receipt) => ({ ...receipt }));
+  }
+
+  nestedEffectAttempts() {
+    return this._nestedEffectAttempts.map((attempt) => ({ ...attempt }));
+  }
+
+  nestedEffectSettlements() {
+    return this._nestedEffectSettlements.map((settlement) => ({
+      ...settlement,
+    }));
+  }
+
+  _recordNestedEffectAttempt(event) {
+    if (!this._workflowEffectId) return;
+    const attempt = {
+      protocol: event?.workflowEffectProtocol,
+      workflowEffectId: event?.workflowEffectId,
+      childEffectId: event?.workflowChildEffectId,
+      childSequence: event?.workflowChildSequence,
+      kind: "tool",
+      tool: event?.tool,
+      toolUseId: event?.tool_use_id,
+      identitySemantics: "runtime-derived",
+    };
+    if (
+      attempt.protocol !== WORKFLOW_CHILD_EFFECT_PROTOCOL ||
+      attempt.workflowEffectId !== this._workflowEffectId ||
+      !WORKFLOW_EFFECT_ID_RE.test(attempt.childEffectId || "") ||
+      !Number.isSafeInteger(attempt.childSequence) ||
+      attempt.childSequence < 1 ||
+      !WORKFLOW_TOOL_NAME_RE.test(attempt.tool || "") ||
+      !WORKFLOW_TOOL_CALL_ID_RE.test(attempt.toolUseId || "") ||
+      this._nestedEffectAttempts.some(
+        (existing) =>
+          existing.childEffectId === attempt.childEffectId ||
+          existing.childSequence === attempt.childSequence,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow nested-effect boundary is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_CHILD_EFFECT_BOUNDARY_INVALID";
+      throw error;
+    }
+    this._nestedEffectAttempts.push(Object.freeze(attempt));
+  }
+
+  _recordNestedEffectSettlement(event) {
+    if (!this._workflowEffectId || !event?.workflowChildEffectId) return null;
+    const attempt = this._nestedEffectAttempts.find(
+      (candidate) =>
+        candidate.childEffectId === event.workflowChildEffectId,
+    );
+    const outcomeUnknown = ownDataValue(event.result, "outcomeUnknown") === true;
+    const resultError = ownDataValue(event.result, "error");
+    const mcpLedgerId = ownDataValue(event.result, "mcpLedgerId") ?? null;
+    const settlement = {
+      protocol: event?.workflowEffectProtocol,
+      workflowEffectId: event?.workflowEffectId,
+      childEffectId: event?.workflowChildEffectId,
+      childSequence: event?.workflowChildSequence,
+      kind: "tool",
+      tool: event?.tool,
+      toolUseId: event?.tool_use_id,
+      status: outcomeUnknown
+        ? "outcome_unknown"
+        : event?.error || resultError
+          ? "failed"
+          : "completed",
+      outcomeUnknown,
+      mcpLedgerId,
+      mcpLedgerPrewritePersisted:
+        ownDataValue(event.result, "mcpLedgerPrewritePersisted") === true,
+      mcpLedgerSettlementPersisted:
+        ownDataValue(event.result, "mcpLedgerSettlementPersisted") === true,
+    };
+    if (
+      !attempt ||
+      settlement.protocol !== WORKFLOW_CHILD_EFFECT_PROTOCOL ||
+      settlement.workflowEffectId !== this._workflowEffectId ||
+      settlement.childSequence !== attempt.childSequence ||
+      settlement.tool !== attempt.tool ||
+      settlement.toolUseId !== attempt.toolUseId ||
+      (mcpLedgerId !== null &&
+        !PROVIDER_CALL_ID_RE.test(String(mcpLedgerId))) ||
+      this._nestedEffectSettlements.some(
+        (existing) => existing.childEffectId === settlement.childEffectId,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow nested-effect settlement is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_CHILD_EFFECT_SETTLEMENT_INVALID";
+      error.workflowEffectOutcomeUnknown = true;
+      throw error;
+    }
+    this._nestedEffectSettlements.push(Object.freeze(settlement));
+    return settlement;
+  }
+
+  _recordProviderRequestAttempt(event) {
+    if (!this._workflowEffectId) return;
+    const attempt = {
+      protocol: "cc-provider-request-attempt/v1",
+      provider: event?.provider,
+      workflowEffectId: event?.workflowEffectId,
+      callId: event?.callId,
+      callSequence: event?.callSequence,
+      source: event?.source,
+      clientRequestId: event?.providerRequestId,
+      requestIdentitySemantics: event?.requestIdentitySemantics,
+    };
+    if (
+      !PROVIDER_NAME_RE.test(attempt.provider || "") ||
+      attempt.workflowEffectId !== this._workflowEffectId ||
+      !PROVIDER_CALL_ID_RE.test(attempt.callId || "") ||
+      !Number.isSafeInteger(attempt.callSequence) ||
+      attempt.callSequence < 1 ||
+      !["model", "semantic-compaction"].includes(attempt.source) ||
+      !PROVIDER_CLIENT_REQUEST_ID_RE.test(attempt.clientRequestId || "") ||
+      attempt.requestIdentitySemantics !== "trace-only" ||
+      this._providerRequestAttempts.some(
+        (existing) => existing.callId === attempt.callId,
+      )
+    ) {
+      const error = new TypeError(
+        "workflow provider request boundary is malformed or duplicated",
+      );
+      error.code = "CC_WORKFLOW_PROVIDER_REQUEST_BOUNDARY_INVALID";
+      throw error;
+    }
+    this._providerRequestAttempts.push(Object.freeze(attempt));
+  }
+
   /**
    * True when this sub-agent has been asked to stop — either via an external
    * abort signal or via this context's own `abort()` (precise single-agent

package/src/lib/task-model-selector.js

@@ -24,7 +24,7 @@ export const TaskType = {
  */
 const TASK_MODEL_MAP = {
   [TaskType.CHAT]: {
-    volcengine: "doubao-seed-2-1-pro-260628",
+    volcengine: "deepseek-v4-flash-260425",
     openai: "gpt-4o-mini",
     anthropic: "claude-sonnet-4-6",
     deepseek: "deepseek-chat",

package/src/lib/with-file-lock.js

@@ -12,10 +12,13 @@
  * `timeoutMs`, it proceeds unlocked. Callers that set `failIfUnavailable` get a
  * strict lock: every owner has a PID + unguessable token, a live owner is never
  * reclaimed merely because the directory is old, and corrupt ownership fails
- * closed. Confirmed-dead owners are reclaimed with an exact-token marker inside
- * the lock directory so a delayed contender cannot delete a replacement lock.
- * Strict callers may use bounded jittered retries and an after-release yield to
- * avoid Windows sharing transients and fixed-interval lock convoys.
+ * closed. The default filesystem publishes a fully populated, uniquely staged
+ * directory in one rename so a process killed during acquisition cannot expose
+ * an ownerless lock. Confirmed-dead owners are reclaimed with an exact-token
+ * marker inside the lock directory so a delayed contender cannot delete a
+ * replacement lock. Strict callers may use bounded jittered retries and an
+ * after-release yield to avoid Windows sharing transients and fixed-interval
+ * lock convoys.
  *
  * @param {string} targetPath  the file being guarded (lock is `${targetPath}.lock`)
  * @param {(ctx:{locked:boolean})=>T} fn  critical section; receives whether the lock was held
@@ -37,6 +40,10 @@ export function withFileLock(targetPath, fn, opts = {}) {
     _ownerToken = () => randomUUID(),
     failIfUnavailable = false,
   } = opts;
+  const isOwnerAlive =
+    typeof opts._isOwnerAlive === "function"
+      ? opts._isOwnerAlive
+      : (candidate) => _isProcessAlive(candidate.pid);
 
   const lockDir = `${targetPath}.lock`;
   const ownerPath = path.join(lockDir, "owner.json");
@@ -52,36 +59,9 @@ export function withFileLock(targetPath, fn, opts = {}) {
 
   for (;;) {
     try {
-      _fs.mkdirSync(lockDir);
-      try {
-        _fs.writeFileSync(ownerPath, JSON.stringify(owner), {
-          encoding: "utf8",
-          mode: 0o600,
-          flag: "wx",
-        });
-        held = true;
-        break;
-      } catch (error) {
-        _fs.rmSync(lockDir, { recursive: true, force: true });
-        acquisitionError = error;
-        if (
-          failIfUnavailable &&
-          isTransientLockError(error) &&
-          waitForRetry({
-            _now,
-            _sleep,
-            _random,
-            deadline,
-            retryAttempt: retryAttempt++,
-            retryMs,
-            maxRetryMs,
-            retryJitterMs,
-          })
-        ) {
-          continue;
-        }
-        break;
-      }
+      acquireOwnedDirectory(_fs, lockDir, owner);
+      held = true;
+      break;
     } catch (error) {
       if (!error || error.code !== "EEXIST") {
         acquisitionError = error;
@@ -108,8 +88,23 @@ export function withFileLock(targetPath, fn, opts = {}) {
       const incumbent = ownerRead.owner;
       acquisitionError = ownerRead.error;
       if (incumbent) {
-        if (!_isProcessAlive(incumbent.pid)) {
-          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, _isProcessAlive)) {
+        // The owner writes this exact-token marker only after its critical
+        // section has finished. A Windows sharing violation can then prevent
+        // the final recursive removal while the owner process remains alive,
+        // which would otherwise strand every later strict caller behind a
+        // lock that no longer protects any work. Complete only the release
+        // explicitly published by the still-current owner; a missing,
+        // corrupt or mismatched marker remains fail-closed.
+        const publishedRelease = completePublishedRelease(
+          _fs,
+          lockDir,
+          incumbent,
+          owner,
+          isOwnerAlive,
+        );
+        if (publishedRelease.completed) continue;
+        if (!publishedRelease.published && !isOwnerAlive(incumbent)) {
+          if (reclaimOwnedDirectory(_fs, lockDir, incumbent, isOwnerAlive)) {
             continue;
           }
         }
@@ -166,7 +161,7 @@ export function withFileLock(targetPath, fn, opts = {}) {
   let releaseError = null;
   if (held) {
     try {
-      released = releaseOwnedDirectory(_fs, lockDir, owner);
+      released = releaseOwnedDirectory(_fs, lockDir, owner, isOwnerAlive);
     } catch (error) {
       releaseError = error;
     }
@@ -180,8 +175,9 @@ export function withFileLock(targetPath, fn, opts = {}) {
     throw error;
   }
   if (held && released && yieldAfterReleaseMs > 0) {
-    // The lock is already gone. This lets an existing waiter run before a
-    // process performing many tiny transactions can immediately reacquire it.
+    // The lock is gone or its exact release marker has transferred cleanup to
+    // contenders. Let an existing waiter run before a process performing many
+    // tiny transactions can immediately reacquire it.
     _sleep(yieldAfterReleaseMs);
   }
   return result;
@@ -200,6 +196,61 @@ const defaultFs = {
   rmSync: (p, o) => fs.rmSync(p, o),
 };
 
+function acquireOwnedDirectory(_fs, lockDir, owner) {
+  const serializedOwner = JSON.stringify(owner);
+  // Injected legacy filesystems used by a few consumers may not implement
+  // rename. Keep their old acquire path, while the real Node filesystem always
+  // uses the crash-safe staged publication below.
+  if (typeof _fs.renameSync !== "function") {
+    _fs.mkdirSync(lockDir);
+    try {
+      _fs.writeFileSync(path.join(lockDir, "owner.json"), serializedOwner, {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+      });
+      return;
+    } catch (error) {
+      _fs.rmSync(lockDir, { recursive: true, force: true });
+      throw error;
+    }
+  }
+
+  const candidateDir = `${lockDir}.acquire-${owner.token}`;
+  try {
+    _fs.mkdirSync(candidateDir);
+    _fs.writeFileSync(path.join(candidateDir, "owner.json"), serializedOwner, {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    _fs.renameSync(candidateDir, lockDir);
+  } catch (error) {
+    try {
+      _fs.rmSync(candidateDir, { recursive: true, force: true });
+    } catch {
+      /* uniquely-tokened acquisition debris cannot block the lock path */
+    }
+    if (directoryExists(_fs, lockDir)) {
+      const contention = new Error("State lock already exists", {
+        cause: error,
+      });
+      contention.code = "EEXIST";
+      throw contention;
+    }
+    throw error;
+  }
+}
+
+function directoryExists(_fs, target) {
+  try {
+    _fs.statSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -310,7 +361,7 @@ function writeOwnerMarker(_fs, markerPath, owner) {
   });
 }
 
-function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
+function reclaimOwnedDirectory(_fs, lockDir, owner, ownerAlive) {
   const markerPath = path.join(lockDir, `.reclaim-${owner.token}`);
   try {
     writeOwnerMarker(_fs, markerPath, owner);
@@ -319,7 +370,7 @@ function reclaimOwnedDirectory(_fs, lockDir, owner, processAlive) {
     throw error;
   }
   const current = readOwner(_fs, path.join(lockDir, "owner.json"));
-  if (!sameOwner(current, owner) || processAlive(owner.pid)) {
+  if (!sameOwner(current, owner) || ownerAlive(owner)) {
     removeOwnMarker(_fs, markerPath, owner);
     return false;
   }
@@ -348,7 +399,69 @@ function reclaimLegacyDirectory(_fs, lockDir, stat) {
   return true;
 }
 
-function releaseOwnedDirectory(_fs, lockDir, owner) {
+function completePublishedRelease(_fs, lockDir, owner, claimant, ownerAlive) {
+  const markerPath = path.join(lockDir, `.release-${owner.token}`);
+  if (!sameOwner(readOwner(_fs, markerPath), owner)) {
+    return { published: false, completed: false };
+  }
+  const claimPath = path.join(lockDir, `.release-claim-${owner.token}`);
+  for (;;) {
+    const existingClaim = readOwner(_fs, claimPath);
+    if (existingClaim) {
+      if (sameOwner(existingClaim, claimant)) break;
+      if (!ownerAlive(existingClaim)) {
+        if (removeOwnMarker(_fs, claimPath, existingClaim)) continue;
+      }
+      return { published: true, completed: false };
+    }
+    try {
+      writeOwnerMarker(_fs, claimPath, claimant);
+      break;
+    } catch (error) {
+      if (error?.code === "ENOENT") {
+        return { published: true, completed: !directoryExists(_fs, lockDir) };
+      }
+      if (error?.code === "EEXIST" || isTransientLockError(error)) {
+        return { published: true, completed: false };
+      }
+      throw error;
+    }
+  }
+  if (!sameOwner(readOwner(_fs, path.join(lockDir, "owner.json")), owner)) {
+    removeOwnMarker(_fs, claimPath, claimant);
+    return { published: true, completed: false };
+  }
+  const cleanupDir = `${lockDir}.released-${owner.token}-${claimant.token}`;
+  try {
+    // Detach the exact released directory from the acquisition path before
+    // cleaning it. Recursive removal may span several Windows filesystem
+    // operations; deleting `lockDir` in place lets a new atomic acquirer
+    // install a replacement between those operations and risks deleting that
+    // replacement. The claimant token makes delayed cleanup private to this
+    // handoff, just like the owner's normal rename-first release path.
+    _fs.renameSync(lockDir, cleanupDir);
+    try {
+      _fs.rmSync(cleanupDir, { recursive: true, force: true });
+    } catch {
+      // The acquisition path is already free. A uniquely named released
+      // directory is harmless bounded debris if Windows still holds a handle.
+    }
+    return { published: true, completed: true };
+  } catch (error) {
+    removeOwnMarker(_fs, claimPath, claimant);
+    if (error?.code === "ENOENT") {
+      return { published: true, completed: !directoryExists(_fs, lockDir) };
+    }
+    // A Windows sharing transient leaves the exact release marker in place so
+    // this or another contender can retry within its normal deadline.
+    if (isTransientLockError(error)) {
+      return { published: true, completed: false };
+    }
+    throw error;
+  }
+}
+
+function releaseOwnedDirectory(_fs, lockDir, owner, ownerAlive) {
   if (!sameOwner(readOwner(_fs, path.join(lockDir, "owner.json")), owner)) {
     return false;
   }
@@ -384,6 +497,18 @@ function releaseOwnedDirectory(_fs, lockDir, owner) {
     removeOwnMarker(_fs, markerPath, owner);
     return false;
   }
+  if (typeof _fs.renameSync === "function") {
+    // After publishing the marker, use the same exclusive claim protocol as a
+    // later contender. The releasing process must not perform an unclaimed,
+    // delayed delete: another process could complete the release and install a
+    // replacement lock before that delete resumes.
+    // Publishing the exact release marker is the logical handoff point. A
+    // contender may win the cleanup claim before this owner does; that is a
+    // successful release, not lost ownership, because every acquirer must
+    // complete or wait behind the published marker before entering its body.
+    return completePublishedRelease(_fs, lockDir, owner, owner, ownerAlive)
+      .published;
+  }
   _fs.rmSync(lockDir, { recursive: true, force: true });
   return true;
 }