harnery 0.43.0 → 0.45.0

package/dist/core/workflow/workspaces/leases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leases.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/leases.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;IACpC,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,OAAO,IAAI,IAAI,CAAC;CACjB;AAUD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,cAAc,CA+GvF"}
+{"version":3,"file":"leases.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/leases.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,8EAA8E;IAC9E,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;IACpC,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,OAAO,IAAI,IAAI,CAAC;CACjB;AAUD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,cAAc,CAgHvF"}

package/dist/core/workflow/workspaces/leases.js

@@ -71,8 +71,8 @@ export function acquireNoClobberLease(input) {
         if (observed === undefined) {
             throw new Error(`lease ${input.scope} changed repeatedly during contention`);
         }
-        if (leaseIsLive(observed.owner, now(), input.staleAfterMs)) {
-            throw new Error(`lease ${input.scope} is held by a live or unexpired owner`);
+        if (leaseIsLive(observed.owner, now(), input.staleAfterMs, input.probePid)) {
+            throw new Error(`lease ${input.scope} is held by a live or unexpired owner, or its liveness is unknown`);
         }
         if (observed.owner.scope !== input.scope ||
             (input.validateStaleOwner !== undefined && !input.validateStaleOwner(observed.owner))) {
@@ -87,7 +87,7 @@ export function acquireNoClobberLease(input) {
             assertSameInodeAndBytes(currentPath, pinPath, observed.bytes);
         }
         catch {
-            abortUnchangedRecoveryClaim(leaseDir, recoveryPath, pinPath, owner);
+            abortUnchangedRecoveryClaim(leaseDir, recoveryPath, owner);
             recoveryClaimed = false;
             throw new Error(`lease ${input.scope} recovery raced with another contender`);
         }
@@ -102,10 +102,7 @@ export function acquireNoClobberLease(input) {
         fsyncDirectory(leaseDir);
         input.onRecoveryStep?.("new_current_linked");
         removePinnedOwner(leaseDir, pinPath, observed.owner);
-        unlinkSync(pinPath);
-        unlinkSync(join(recoveryPath, "claim.json"));
-        rmdirSync(recoveryPath);
-        fsyncDirectory(leaseDir);
+        retireRecoveryClaim(leaseDir, recoveryPath, owner, () => input.onRecoveryStep?.("recovery_retired"));
         return {
             ...leaseHandle(leaseDir, ownerPath, ownerBytes, owner),
             recovered_owner: observed.owner,
@@ -184,7 +181,7 @@ function createRecoveryClaim(leaseDir, recoveryPath, claimant, observed) {
 }
 function reclaimAbandonedRecovery(leaseDir, recoveryPath, input, now) {
     const claim = readRecoveryClaim(recoveryPath);
-    if (leaseIsLive(claim.claimant, now, input.staleAfterMs)) {
+    if (leaseIsLive(claim.claimant, now, input.staleAfterMs, input.probePid)) {
         throw new Error(`lease ${input.scope} recovery is already in progress`);
     }
     if (claim.claimant.scope !== input.scope ||
@@ -231,14 +228,27 @@ function reclaimAbandonedRecovery(leaseDir, recoveryPath, input, now) {
     rmdirSync(quarantine);
     fsyncDirectory(leaseDir);
 }
-function abortUnchangedRecoveryClaim(leaseDir, recoveryPath, pinPath, claimant) {
+function abortUnchangedRecoveryClaim(leaseDir, recoveryPath, claimant) {
     const claim = readRecoveryClaim(recoveryPath);
     if (claim.claimant.owner_id !== claimant.owner_id) {
         throw new Error(`lease ${claimant.scope} recovery ownership changed`);
     }
-    safeUnlink(pinPath);
-    unlinkSync(join(recoveryPath, "claim.json"));
-    rmdirSync(recoveryPath);
+    retireRecoveryClaim(leaseDir, recoveryPath, claimant);
+}
+/**
+ * Move this claimant's recovery directory to a private name before emptying
+ * it. Renaming a directory onto an existing empty directory replaces it, so
+ * emptying `recovery` in place would let a contender's claim land there and
+ * fail this claimant's final rmdir after it already holds the lease.
+ */
+function retireRecoveryClaim(leaseDir, recoveryPath, claimant, onRetired) {
+    const retired = join(leaseDir, `recovery-retired-${claimant.owner_id}`);
+    renameSync(recoveryPath, retired);
+    fsyncDirectory(leaseDir);
+    onRetired?.();
+    safeUnlink(join(retired, "stale-pin"));
+    unlinkSync(join(retired, "claim.json"));
+    rmdirSync(retired);
     fsyncDirectory(leaseDir);
 }
 function readRecoveryClaim(recoveryPath) {
@@ -355,7 +365,9 @@ function isStringRecord(value) {
         !Array.isArray(value) &&
         Object.entries(value).every(([key, item]) => SAFE_COMPONENT.test(key) && typeof item === "string" && item.length <= 1_000));
 }
-function leaseIsLive(owner, now, staleAfterMs) {
+function leaseIsLive(owner, now, staleAfterMs, probePid = (pid) => {
+    process.kill(pid, 0);
+}) {
     const created = Date.parse(owner.created_at);
     const expires = Date.parse(owner.expires_at);
     if (!Number.isFinite(created) ||
@@ -365,14 +377,16 @@ function leaseIsLive(owner, now, staleAfterMs) {
         now < expires) {
         return true;
     }
+    // Expiry only makes a same-host owner eligible for a process check. Neither
+    // a remote owner nor an unreadable probe proves that its work has stopped.
     if (owner.host !== hostname())
-        return false;
+        return true;
     try {
-        process.kill(owner.pid, 0);
+        probePid(owner.pid);
         return true;
     }
     catch (error) {
-        return error.code === "EPERM";
+        return error.code !== "ESRCH";
     }
 }
 function assertExactOwner(currentPath, ownerPath, expectedBytes, owner) {

package/dist/core/workflow/workspaces/local-git.d.ts

@@ -1,8 +1,12 @@
-import type { WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProvider } from "./types.js";
+import { type WorkspaceReclaimOptions, type WorkspaceReclaimResult } from "./reclaim.js";
+import type { WorkspaceBinding, WorkspaceProbeInput, WorkspaceProbeResult, WorkspaceProvider } from "./types.js";
 export interface LocalGitWorktreeProviderOptions {
     coordRoot: string;
     descriptorPathsSupported?: () => boolean;
 }
-export declare function createLocalGitWorktreeProvider(options: LocalGitWorktreeProviderOptions): WorkspaceProvider;
+export interface LocalGitWorktreeProvider extends WorkspaceProvider {
+    reclaim(binding: WorkspaceBinding, options: WorkspaceReclaimOptions): Promise<WorkspaceReclaimResult>;
+}
+export declare function createLocalGitWorktreeProvider(options: LocalGitWorktreeProviderOptions): LocalGitWorktreeProvider;
 export declare function probe(input: WorkspaceProbeInput, descriptorPathsSupported?: () => boolean): Promise<WorkspaceProbeResult>;
 //# sourceMappingURL=local-git.d.ts.map

package/dist/core/workflow/workspaces/local-git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/local-git.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAgBV,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;CAC1C;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,iBAAiB,CAgBnB;AAED,wBAAsB,KAAK,CACzB,KAAK,EAAE,mBAAmB,EAC1B,wBAAwB,GAAE,MAAM,OAAwC,GACvE,OAAO,CAAC,oBAAoB,CAAC,CA4E/B"}
+{"version":3,"file":"local-git.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/local-git.ts"],"names":[],"mappings":"AA8CA,OAAO,EAML,KAAK,uBAAuB,EAE5B,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAiBtB,OAAO,KAAK,EAYV,gBAAgB,EAIhB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB,CAAC,EAAE,MAAM,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,OAAO,CACL,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,wBAAwB,CAkB1B;AAED,wBAAsB,KAAK,CACzB,KAAK,EAAE,mBAAmB,EAC1B,wBAAwB,GAAE,MAAM,OAAwC,GACvE,OAAO,CAAC,oBAAoB,CAAC,CA4E/B"}

package/dist/core/workflow/workspaces/local-git.js

@@ -2,12 +2,17 @@ import { randomBytes } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.js";
+import { beginWorkflowRecovery, validateWorkflowRecoveryAuthorization } from "../recovery-audit.js";
+import { acquireWorkflowResumeLease } from "../run-state.js";
 import { WorkspaceAttestationError } from "./attestation-error.js";
+import { cleanupWorkspace } from "./cleanup.js";
 import { git, gitMaybe, gitMaybeWithDirectoryDescriptor, gitOperations, isAncestor, nulEntries, overwriteRiskPaths, parseWorktreeInventory, worktreeInventory, } from "./git.js";
 import { acquireNoClobberLease } from "./leases.js";
+import { claimOverlapsWorkspace, reserveWorkspaceReclaim, } from "./ownership.js";
 import { assertContainedExisting, assertPathIdentity, candidateUnderRoot, containsPath, createContainedDirectories, descriptorBackedPathsSupported, descriptorPath, filesystemIdentity, openContainedDirectory, sameFilesystemIdentity, validateConfiguredRoot, } from "./paths.js";
-import { readWorkflowLiveness } from "./recovery.js";
-import { appendWorkspaceEvent, fileSha256, readWorkflowSupplement, readWorkspaceBinding, readWorkspaceClaim, readWorkspaceEvents, stableDigest, workspaceClaimPath, workspaceLockPath, writeWorkspaceBinding, writeWorkspaceClaim, } from "./state.js";
+import { prepareReclaim, WorkflowReclaimError, } from "./reclaim.js";
+import { hasActiveWorkflowEvidence, readWorkflowLiveness } from "./recovery.js";
+import { appendWorkspaceEvent, fileSha256, readWorkflowSupplement, readWorkspaceBinding, readWorkspaceClaim, readWorkspaceClaims, readWorkspaceEvents, stableDigest, workspaceClaimPath, workspaceLockPath, writeWorkspaceBinding, writeWorkspaceClaim, } from "./state.js";
 import { isWorkspaceAttestation } from "./validate.js";
 const PROVIDER_ID = "local-git-worktree";
 const PROVIDER_VERSION = "1";
@@ -17,7 +22,7 @@ const OBJECT_FORMAT = /^[a-f0-9]{40,64}$/;
 const REF_FORMAT = /^refs\/heads\/[A-Za-z0-9][A-Za-z0-9._/-]{0,180}$/;
 export function createLocalGitWorktreeProvider(options) {
     const coordRoot = resolve(options.coordRoot);
-    return {
+    const provider = {
         probe: (input) => probe(input, options.descriptorPathsSupported),
         allocate: (request) => allocate(coordRoot, request),
         readBinding: async (binding) => {
@@ -30,7 +35,9 @@ export function createLocalGitWorktreeProvider(options) {
         previewIntegration: (input) => previewIntegration(coordRoot, input),
         applyAuthorizedIntegration: (input) => applyAuthorizedIntegration(coordRoot, input),
         cleanup: (binding, intent) => cleanup(coordRoot, binding, intent),
+        reclaim: (binding, reclaimOptions) => reclaim(coordRoot, provider, binding, reclaimOptions),
     };
+    return provider;
 }
 export async function probe(input, descriptorPathsSupported = descriptorBackedPathsSupported) {
     const unsupported = [];
@@ -585,6 +592,293 @@ function cancelUnderLease(coordRoot, binding, claim) {
     appendWorkspaceEvent(coordRoot, claim, "cancellation_outcome", { status: "cancelled" });
     return { ...base, status: "cancelled" };
 }
+function reclaimPreview(coordRoot, binding, mode) {
+    const preview = {
+        action: "preview",
+        run_id: binding.run_id,
+        mode,
+        liveness: readWorkflowLiveness(coordRoot, binding.run_id),
+        evidence_sha256: reclaimEvidenceDigest(coordRoot, binding),
+        ownership: "unproven",
+        dirty_paths: null,
+        lease_holder: reclaimLeaseHolders(coordRoot, binding),
+    };
+    try {
+        const current = attestSync(coordRoot, binding);
+        if (current.status === "ok") {
+            preview.ownership = "ok";
+            preview.dirty_paths = [...(current.repository?.dirty_paths ?? [])];
+        }
+        else {
+            preview.ownership_detail =
+                current.provider_drift.join("; ") || "ownership attestation failed";
+        }
+    }
+    catch (error) {
+        preview.ownership_detail = error.message;
+    }
+    return preview;
+}
+function reclaimEvidenceDigest(coordRoot, binding) {
+    const evidence = (name) => {
+        try {
+            return readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, name), "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    };
+    return stableDigest({
+        binding,
+        proof: evidence("proof.json"),
+        transcript: evidence("transcript.jsonl"),
+    });
+}
+function assertReclaimLiveness(coordRoot, binding, recovery) {
+    const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
+    if (liveness === "active" || (recovery && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
+        throw new WorkflowReclaimError("workflow_reclaim_run_live", `run ${binding.run_id} has active evidence; its workspace was left untouched`);
+    }
+    if (recovery && reclaimEvidenceDigest(coordRoot, binding) !== recovery.evidenceSha256) {
+        throw new WorkflowReclaimError("workflow_reclaim_recovery_mismatch", "workflow reclaim requires the exact current preview evidence digest");
+    }
+    if (liveness === "inactive")
+        return;
+    if (liveness === "unknown" && recovery)
+        return;
+    throw new WorkflowReclaimError("workflow_reclaim_liveness_unknown", `run ${binding.run_id} has missing, corrupt, or ambiguous liveness evidence; its workspace was left untouched`);
+}
+function assertReclaimOwnership(coordRoot, binding) {
+    try {
+        const claim = requiredClaim(coordRoot, binding);
+        const current = attestSync(coordRoot, binding);
+        if (current.status !== "ok") {
+            throw new Error(current.provider_drift.join("; ") || "ownership attestation failed");
+        }
+        return claim;
+    }
+    catch (error) {
+        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
+    }
+}
+function assertPeerWorkspaceAuthority(coordRoot, claim) {
+    try {
+        for (const peer of readWorkspaceClaims(coordRoot, PROVIDER_ID)) {
+            if (peer.binding_id === claim.binding_id)
+                continue;
+            const binding = readWorkspaceBinding(coordRoot, PROVIDER_ID, peer.binding_id);
+            const events = readWorkspaceEvents(coordRoot, PROVIDER_ID, peer.binding_id);
+            if (binding)
+                requiredClaim(coordRoot, binding);
+            else if (events.some((event) => event.event === "bound")) {
+                throw new Error("retained peer binding authority is missing");
+            }
+            if (!claimOverlapsWorkspace(peer, claim.workspace_root))
+                continue;
+            // Process termination, archival and an expired reservation do not release
+            // a resource. Require the provider's release record AND current absence.
+            if (binding && events.some((event) => event.event === "released")) {
+                const current = attestSync(coordRoot, binding);
+                if (current.status === "ok" && current.resource_state === "released")
+                    continue;
+            }
+            throw new Error(`retained peer workspace ${peer.binding_id} overlaps the reclaim path`);
+        }
+    }
+    catch (error) {
+        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
+    }
+}
+function reclaimAuthorityGuard(coordRoot, binding, claim, reservation, recovery) {
+    try {
+        reservation.assertCurrent();
+        assertReclaimLiveness(coordRoot, binding, recovery);
+        assertReclaimOwnership(coordRoot, binding);
+        assertPeerWorkspaceAuthority(coordRoot, claim);
+    }
+    catch (error) {
+        if (error instanceof WorkflowReclaimError)
+            throw error;
+        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
+    }
+}
+async function reclaim(coordRoot, provider, binding, options) {
+    if (options.mode !== "salvage" && options.mode !== "discard") {
+        throw new Error("unsupported workspace reclaim mode");
+    }
+    if (!options.yes)
+        return reclaimPreview(coordRoot, binding, options.mode);
+    if (options.unknownLiveness)
+        validateWorkflowRecoveryAuthorization(options.unknownLiveness);
+    // Liveness comes before terminal-proof cleanup helpers. A live run may not
+    // have a proof yet, and a missing proof must never be discovered after reset.
+    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
+    const claim = assertReclaimOwnership(coordRoot, binding);
+    let reservation;
+    try {
+        reservation = reserveWorkspaceReclaim(coordRoot, claim);
+    }
+    catch (error) {
+        throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
+    }
+    try {
+        reclaimAuthorityGuard(coordRoot, binding, claim, reservation, options.unknownLiveness);
+        let releaseResume;
+        try {
+            releaseResume = acquireWorkflowResumeLease(coordRoot, binding.run_id);
+        }
+        catch (error) {
+            throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
+        }
+        try {
+            let releaseBinding;
+            try {
+                releaseBinding = acquireLease(coordRoot, workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id), claim, "binding");
+            }
+            catch (error) {
+                throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
+            }
+            try {
+                let releaseRepository;
+                try {
+                    releaseRepository = acquireRepositoryLease(coordRoot, claim);
+                }
+                catch (error) {
+                    throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
+                }
+                try {
+                    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
+                    assertReclaimOwnership(coordRoot, binding);
+                    const preview = reclaimPreview(coordRoot, binding, options.mode);
+                    const audit = options.unknownLiveness
+                        ? beginWorkflowRecovery(coordRoot, {
+                            run_id: binding.run_id,
+                            action: "reclaim_unknown_liveness",
+                            actor: options.unknownLiveness.actor,
+                            reason: options.unknownLiveness.reason,
+                            target_sha256: options.unknownLiveness.evidenceSha256,
+                            target: {
+                                binding_id: binding.binding_id,
+                                workspace_root: binding.workspace_root,
+                                mode: options.mode,
+                                liveness: preview.liveness,
+                            },
+                        })
+                        : undefined;
+                    let preparation;
+                    // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
+                    // Its provider callback uses the leases already held here instead of
+                    // trying to acquire them again. Preparation occurs only after all of
+                    // cleanup's path, ownership, ref and registration checks have succeeded.
+                    const cleanupResult = await cleanupWorkspace({
+                        coordRoot,
+                        runId: binding.run_id,
+                        provider: {
+                            ...provider,
+                            cleanup: async (candidate, intent) => {
+                                assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
+                                assertReclaimOwnership(coordRoot, candidate);
+                                return cleanupUnderLease(coordRoot, candidate, claim, intent, {
+                                    mode: options.mode,
+                                    recovery: options.unknownLiveness,
+                                    beforeEffect: () => {
+                                        audit?.assertCurrent();
+                                        reclaimAuthorityGuard(coordRoot, candidate, claim, reservation, options.unknownLiveness);
+                                    },
+                                    beforeRefEffect: () => {
+                                        audit?.assertCurrent();
+                                        reservation.assertCurrent();
+                                        assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
+                                        requiredClaim(coordRoot, candidate);
+                                        assertPeerWorkspaceAuthority(coordRoot, claim);
+                                    },
+                                    prepared: (value) => {
+                                        preparation = value;
+                                    },
+                                });
+                            },
+                        },
+                    });
+                    if (!preparation &&
+                        cleanupResult.status !== "released" &&
+                        cleanupResult.status !== "already_released") {
+                        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
+                            "workspace cleanup preconditions could not be proved");
+                    }
+                    if (cleanupResult.status === "released" || cleanupResult.status === "already_released")
+                        audit?.complete();
+                    return {
+                        ...preview,
+                        action: "reclaimed",
+                        lease_holder: [],
+                        preparation: preparation ?? {
+                            action: "already_gone",
+                            detail: "the workspace is already released",
+                        },
+                        cleanup: cleanupResult,
+                    };
+                }
+                finally {
+                    releaseRepository();
+                }
+            }
+            finally {
+                releaseBinding();
+            }
+        }
+        finally {
+            releaseResume();
+        }
+    }
+    finally {
+        reservation.release();
+    }
+}
+function reclaimLeaseHolders(coordRoot, binding) {
+    const paths = [
+        ["binding", workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id)],
+    ];
+    if (binding.repository) {
+        const key = stableDigest({ common: binding.repository.common_dir.identity });
+        paths.push([
+            "repository",
+            join(coordRoot, ".harnery", "workspaces", PROVIDER_ID, ".leases", `repository-${key}.lock`),
+        ]);
+    }
+    const holders = [];
+    try {
+        const owner = JSON.parse(readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, "resume.lock"), "utf8"));
+        holders.push({
+            scope: "resume",
+            pid: typeof owner.pid === "number" ? owner.pid : undefined,
+            host: typeof owner.host === "string" ? owner.host : undefined,
+        });
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            holders.push({ scope: "resume", detail: "lease holder could not be read" });
+        }
+    }
+    for (const [scope, path] of paths) {
+        try {
+            const owner = JSON.parse(readFileSync(join(path, "current"), "utf8"));
+            holders.push({
+                scope,
+                owner_id: typeof owner.owner_id === "string" ? owner.owner_id : undefined,
+                pid: typeof owner.pid === "number" ? owner.pid : undefined,
+                host: typeof owner.host === "string" ? owner.host : undefined,
+            });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                holders.push({ scope, detail: "lease holder could not be read" });
+            }
+        }
+    }
+    return holders;
+}
 async function cleanup(coordRoot, binding, intent) {
     if (intent.mode !== "normal")
         throw new Error("unsupported workspace cleanup mode");
@@ -593,7 +887,18 @@ async function cleanup(coordRoot, binding, intent) {
     try {
         const releaseRepository = acquireRepositoryLease(coordRoot, claim);
         try {
-            return cleanupUnderLease(coordRoot, binding, claim, intent);
+            const reservation = reserveWorkspaceReclaim(coordRoot, claim);
+            try {
+                const authorityGuard = () => {
+                    reservation.assertCurrent();
+                    assertPeerWorkspaceAuthority(coordRoot, claim);
+                };
+                authorityGuard();
+                return cleanupUnderLease(coordRoot, binding, claim, intent, undefined, authorityGuard);
+            }
+            finally {
+                reservation.release();
+            }
         }
         finally {
             releaseRepository();
@@ -603,7 +908,7 @@ async function cleanup(coordRoot, binding, intent) {
         releaseBinding();
     }
 }
-function cleanupUnderLease(coordRoot, binding, claim, intent) {
+function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, beforeRemoval) {
     const repository = binding.repository;
     if (!repository ||
         intent.schema_version !== 1 ||
@@ -641,7 +946,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent) {
         };
     }
     const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-    if (liveness !== "inactive") {
+    if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.recovery)) {
         return {
             ...base,
             status: "blocked",
@@ -653,10 +958,11 @@ function cleanupUnderLease(coordRoot, binding, claim, intent) {
     if (before.workspace_exists && before.status !== "ok") {
         return { ...base, status: "blocked", reason: "ownership attestation failed" };
     }
-    if ((before.repository?.dirty_paths.length ?? 0) > 0 ||
+    if ((!reclaimRequest && (before.repository?.dirty_paths.length ?? 0) > 0) ||
         (before.repository?.conflicts.length ?? 0) > 0 ||
         (before.repository?.operation_in_progress.length ?? 0) > 0) {
-        appendWorkspaceEvent(coordRoot, claim, "preserved_dirty");
+        if (!reclaimRequest)
+            appendWorkspaceEvent(coordRoot, claim, "preserved_dirty");
         return {
             ...base,
             status: "preserved_dirty",
@@ -710,6 +1016,17 @@ function cleanupUnderLease(coordRoot, binding, claim, intent) {
             reason: "missing worktree still has ambiguous Git registration",
         };
     }
+    if (reclaimRequest) {
+        assertReclaimLiveness(coordRoot, binding, reclaimRequest.recovery);
+        assertReclaimOwnership(coordRoot, binding);
+        revalidateClaimResources(claim, root);
+        reclaimRequest.prepared(prepareReclaim({
+            worktreePath: binding.workspace_root,
+            mode: reclaimRequest.mode,
+            runId: binding.run_id,
+            beforeEffect: reclaimRequest.beforeEffect,
+        }));
+    }
     appendWorkspaceEvent(coordRoot, claim, "cleanup_pending", {
         worktree_path: binding.workspace_root,
         gitdir: repository.gitdir,
@@ -719,6 +1036,8 @@ function cleanupUnderLease(coordRoot, binding, claim, intent) {
         target_ref_oid: targetRef.out,
     });
     if (before.workspace_exists) {
+        reclaimRequest?.beforeEffect();
+        beforeRemoval?.();
         revalidateClaimResources(claim, root);
         assertContainedExisting(root, binding.workspace_root, "workspace cleanup path");
         git(repository.source_root.realpath, ["worktree", "remove", binding.workspace_root]);
@@ -738,6 +1057,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent) {
             return { ...base, status: "blocked", reason: "workspace ref changed during cleanup" };
         }
         revalidateClaimResources(claim, root);
+        reclaimRequest?.beforeRefEffect();
         const deleted = gitMaybe(repository.source_root.realpath, [
             "update-ref",
             "-d",

package/dist/core/workflow/workspaces/ownership.d.ts

@@ -0,0 +1,11 @@
+import type { WorkspaceClaim } from "./state.js";
+export interface WorkspaceReclaimReservation {
+    assertCurrent(): void;
+    release(): void;
+}
+/** The immutable claim is the authority; the lease reserves its destructive path. */
+export declare function reserveWorkspaceReclaim(coordRoot: string, claim: WorkspaceClaim): WorkspaceReclaimReservation;
+export declare function publishWorkspaceClaim<T>(coordRoot: string, claim: WorkspaceClaim, publish: () => T): T;
+export declare function assertClaimAuthority(claim: WorkspaceClaim, providerId: string, id: string): void;
+export declare function claimOverlapsWorkspace(claim: WorkspaceClaim, workspaceRoot: string): boolean;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/core/workflow/workspaces/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/ownership.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8CjD,MAAM,WAAW,2BAA2B;IAC1C,aAAa,IAAI,IAAI,CAAC;IACtB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,GACpB,2BAA2B,CAgC7B;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,CAAC,GACf,CAAC,CA8DH;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAwBhG;AAmCD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAU5F"}