harnery 0.43.0 → 0.45.0

package/src/core/workflow/run-state.ts

@@ -1,8 +1,10 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
   chmodSync,
   closeSync,
   existsSync,
+  fsyncSync,
+  lstatSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -23,7 +25,13 @@ import {
 import { stateFileMode } from "../storage/modes.ts";
 import { assertWorkflowRunId, readWorkflowApproval } from "./approvals.ts";
 import { isCanonicalWorkflowAttemptContext } from "./attempt-context.ts";
-import { readJsonRecord, writeImmutableJson } from "./durable-record.ts";
+import {
+  fsyncParentDirectory,
+  readJsonRecord,
+  stableDigest,
+  writeImmutableJson,
+} from "./durable-record.ts";
+import { beginWorkflowRecovery, type WorkflowRecoveryAuthorization } from "./recovery-audit.ts";
 import { normalizeWorkflowSpecialists } from "./specialists.ts";
 import type {
   WorkflowAttemptContext,
@@ -38,6 +46,7 @@ import type {
   WorkspaceBinding,
   WorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/index.ts";
+import { acquireNoClobberLease } from "./workspaces/leases.ts";
 import {
   assertWorkspaceManifestAuthority,
   isWorkspaceBinding,
@@ -47,7 +56,6 @@ import {
 export const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION = 2 as const;
 
 const MANIFEST_LIMIT_BYTES = 256 * 1024;
-const FOREIGN_LEASE_STALE_MS = 24 * 60 * 60 * 1_000;
 
 export interface WorkflowRunManifest {
   schema_version: typeof WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION;
@@ -144,6 +152,13 @@ export function readWorkflowRunManifest(coordRoot: string, runId: string): Workf
   ) {
     throw new Error(`workflow run manifest at ${path} has an unsupported or mismatched schema`);
   }
+  if (manifest.repository_before.observation === undefined) {
+    manifest.repository_before = {
+      ...manifest.repository_before,
+      observation: "unavailable",
+      observation_detail: "No repository observation was recorded.",
+    };
+  }
   assertWorkspaceManifestAuthority(manifest, readManifestWorkspaceRequest(coordRoot, runId));
   return manifest;
 }
@@ -197,51 +212,173 @@ export function workflowRunManifestPath(coordRoot: string, runId: string): strin
   return join(coordRoot, ".harnery", "workflows", runId, "run.json");
 }
 
-/** Acquire an exclusive, crash-recoverable lease for one resume segment. */
+/** Acquire an exclusive lease shared by resume and reclaim. Existing locks
+ * always refuse; explicit audited recovery is a separate operation. */
 export function acquireWorkflowResumeLease(coordRoot: string, runId: string): () => void {
   assertWorkflowRunId(runId);
   const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
-  const owner = { pid: process.pid, host: hostname(), created_at: new Date().toISOString() };
+  const owner = {
+    owner_id: randomUUID(),
+    pid: process.pid,
+    host: hostname(),
+    created_at: new Date().toISOString(),
+  };
+  const ownerBytes = `${JSON.stringify(owner)}\n`;
   mkdirSync(dirname(path), { recursive: true });
 
-  const acquire = (): boolean => {
+  const acquire = (): { device: number; inode: number } | false => {
     try {
       const fd = openSync(path, "wx", stateFileMode());
       try {
-        writeFileSync(fd, `${JSON.stringify(owner)}\n`, "utf8");
+        writeFileSync(fd, ownerBytes, "utf8");
+        fsyncSync(fd);
       } finally {
         closeSync(fd);
       }
       chmodSync(path, stateFileMode());
-      return true;
+      fsyncParentDirectory(path);
+      const identity = lstatSync(path);
+      return { device: identity.dev, inode: identity.ino };
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
       return false;
     }
   };
 
-  if (!acquire()) {
+  const acquired = withResumeLeaseMutation(coordRoot, runId, acquire);
+  if (!acquired) {
     const existing = readResumeLease(path);
-    if (existing && resumeLeaseIsLive(existing)) {
-      throw new Error(
-        `workflow run ${runId} is already being resumed by pid ${existing.pid} on ${existing.host}`,
-      );
-    }
-    unlinkSync(path);
-    if (!acquire())
-      throw new Error(`workflow run ${runId} resume lease raced with another process`);
+    const holder = existing
+      ? ` by pid ${existing.pid} on ${existing.host}; its liveness has not been verified`
+      : "; its owner could not be verified";
+    throw new Error(`workflow run ${runId} resume lease is already held${holder}`);
   }
 
   return () => {
     try {
-      const existing = readResumeLease(path);
-      if (existing?.pid === owner.pid && existing.host === owner.host) unlinkSync(path);
+      // Only this live process can release this nonce. Acquisition never
+      // replaces a present lock, and unlock requires ESRCH for its owner, so
+      // neither supported writer can replace this lock during synchronous
+      // release. Taking their mutation gate would strand a live owner's lock
+      // on ordinary contention. Pin both identity and bytes for stale closures.
+      const identity = lstatSync(path);
+      if (
+        identity.isFile() &&
+        identity.dev === acquired.device &&
+        identity.ino === acquired.inode &&
+        readFileSync(path, "utf8") === ownerBytes
+      ) {
+        unlinkSync(path);
+        fsyncParentDirectory(path);
+      }
     } catch {
-      // Best effort. A stale lease is recoverable on the next resume attempt.
+      // Leave an unreadable or replaced lock untouched.
     }
   };
 }
 
+export interface WorkflowResumeRecoveryOptions extends Partial<WorkflowRecoveryAuthorization> {
+  yes?: boolean;
+  lockSha256?: string;
+}
+
+export interface WorkflowResumeRecoveryResult {
+  action: "preview" | "unlocked";
+  run_id: string;
+  lock_sha256: string | null;
+  owner_state: "dead" | "live" | "unknown" | "absent";
+  owner: { pid: number; host: string; created_at: string } | null;
+  recovery_id?: string;
+}
+
+export function recoverWorkflowResumeLease(
+  coordRoot: string,
+  runId: string,
+  options: WorkflowResumeRecoveryOptions,
+): WorkflowResumeRecoveryResult {
+  assertWorkflowRunId(runId);
+  const path = join(coordRoot, ".harnery", "workflows", runId, "resume.lock");
+  const inspect = (): WorkflowResumeRecoveryResult => {
+    let lockSha256: string;
+    try {
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.size > 8 * 1024)
+        throw new Error("resume lock is not a bounded regular file");
+      lockSha256 = stableDigest({
+        bytes: readFileSync(path, "utf8"),
+        device: stat.dev,
+        inode: stat.ino,
+      });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      return {
+        action: "preview",
+        run_id: runId,
+        lock_sha256: null,
+        owner_state: "absent",
+        owner: null,
+      };
+    }
+    const owner = readResumeLease(path);
+    let ownerState: WorkflowResumeRecoveryResult["owner_state"] = "unknown";
+    if (owner?.host === hostname()) {
+      try {
+        process.kill(owner.pid, 0);
+        ownerState = "live";
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "ESRCH") ownerState = "dead";
+      }
+    }
+    return {
+      action: "preview",
+      run_id: runId,
+      lock_sha256: lockSha256,
+      owner_state: ownerState,
+      owner,
+    };
+  };
+  if (!options.yes) return inspect();
+  return withResumeLeaseMutation(coordRoot, runId, () => {
+    const observed = inspect();
+    if (observed.owner_state !== "dead")
+      throw new Error(`workflow resume unlock refused: owner is ${observed.owner_state}`);
+    if (!options.lockSha256 || options.lockSha256 !== observed.lock_sha256)
+      throw new Error("workflow resume unlock requires the exact current preview digest");
+    const audit = beginWorkflowRecovery(coordRoot, {
+      run_id: runId,
+      action: "unlock_resume",
+      target_sha256: options.lockSha256,
+      target: { lock: "resume.lock", owner: observed.owner },
+      actor: options.actor!,
+      reason: options.reason!,
+    });
+    const current = inspect();
+    if (current.lock_sha256 !== observed.lock_sha256 || current.owner_state !== "dead")
+      throw new Error("workflow resume lock authority changed before unlock");
+    audit.assertCurrent();
+    unlinkSync(path);
+    fsyncParentDirectory(path);
+    audit.complete();
+    return { ...observed, action: "unlocked", recovery_id: audit.intent.operation_id };
+  });
+}
+
+function withResumeLeaseMutation<T>(coordRoot: string, runId: string, action: () => T): T {
+  const authority = stableDigest({ run_id: runId, lock: "resume.lock" });
+  const lease = acquireNoClobberLease({
+    path: join(coordRoot, ".harnery", "workflows", runId, "resume-mutation.lease"),
+    scope: "workflow-resume-mutation",
+    authoritySha256: authority,
+    staleAfterMs: 300_000,
+    validateStaleOwner: (owner) => owner.authority_sha256 === authority,
+  });
+  try {
+    return action();
+  } finally {
+    lease.release();
+  }
+}
+
 function readResumeLease(path: string): { pid: number; host: string; created_at: string } | null {
   try {
     const value = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
@@ -249,7 +386,8 @@ function readResumeLease(path: string): { pid: number; host: string; created_at:
       Number.isSafeInteger(value.pid) &&
       value.pid > 0 &&
       typeof value.host === "string" &&
-      typeof value.created_at === "string"
+      value.host.length > 0 &&
+      validTimestamp(value.created_at)
       ? { pid: value.pid, host: value.host, created_at: value.created_at }
       : null;
   } catch {
@@ -257,19 +395,6 @@ function readResumeLease(path: string): { pid: number; host: string; created_at:
   }
 }
 
-function resumeLeaseIsLive(lease: { pid: number; host: string; created_at: string }): boolean {
-  if (lease.host !== hostname()) {
-    const age = Date.now() - Date.parse(lease.created_at);
-    return Number.isFinite(age) && age < FOREIGN_LEASE_STALE_MS;
-  }
-  try {
-    process.kill(lease.pid, 0);
-    return true;
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code === "EPERM";
-  }
-}
-
 function validExecution(value: WorkflowRunManifest["execution"]): boolean {
   if (!value || typeof value !== "object") return false;
   return (
@@ -352,6 +477,12 @@ function validRepoSnapshot(value: RepoSnapshot): boolean {
   return (
     Boolean(value) &&
     typeof value === "object" &&
+    (value.observation === undefined ||
+      value.observation === "ok" ||
+      value.observation === "partial" ||
+      value.observation === "unavailable") &&
+    (value.observation_detail === undefined ||
+      (typeof value.observation_detail === "string" && value.observation_detail.length <= 500)) &&
     isAbsolute(value.cwd) &&
     (value.root === undefined || isAbsolute(value.root)) &&
     (value.branch === undefined || typeof value.branch === "string") &&

package/src/core/workflow/spawn-claude.ts

@@ -23,6 +23,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -66,6 +67,23 @@ export function buildClaudeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeClaudeResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeClaudeTransportResult(raw);
+  if (result.ok) return result;
+  let text = raw.stdout.trim();
+  let source: "stdout" | "vendor_envelope" = "stdout";
+  try {
+    const envelope = JSON.parse(raw.stdout) as ClaudeEnvelope;
+    if (typeof envelope.result === "string" && envelope.result.length > 0) {
+      text = envelope.result;
+      source = "vendor_envelope";
+    }
+  } catch {
+    // Retain unstructured output without treating it as native authority.
+  }
+  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+
+function normalizeClaudeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-codex.ts

@@ -26,6 +26,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -78,6 +79,18 @@ export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): Ad
 }
 
 export function normalizeCodexResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeCodexTransportResult(raw);
+  if (result.ok) return result;
+  const finalText = raw.resultFileText?.trim();
+  const text = finalText || raw.stdout.trim();
+  return {
+    ...result,
+    text,
+    failureEvidence: observeSpawnFailure(raw, text, finalText ? "final_message" : "stdout"),
+  };
+}
+
+function normalizeCodexTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-cursor.ts

@@ -24,6 +24,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -78,6 +79,23 @@ export function buildCursorInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeCursorResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeCursorTransportResult(raw);
+  if (result.ok) return result;
+  let text = raw.stdout;
+  let source: "stdout" | "vendor_envelope" = "stdout";
+  try {
+    const envelope = JSON.parse(raw.stdout) as CursorEnvelope;
+    if (typeof envelope.result === "string" && envelope.result.length > 0) {
+      text = envelope.result;
+      source = "vendor_envelope";
+    }
+  } catch {
+    // Raw output remains evidence, not an inferred refusal or effect result.
+  }
+  return { ...result, text, failureEvidence: observeSpawnFailure(raw, text, source) };
+}
+
+function normalizeCursorTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/spawn-opencode.ts

@@ -22,6 +22,7 @@ import { builtinAdapterProfile, validateAdapterEffort } from "../adapters/profil
 import type { AdapterInvocation, AdapterRawResult } from "../adapters/types.ts";
 import { notFoundError } from "./adapters.ts";
 import { buildChildEnv } from "./child-env.ts";
+import { observeSpawnFailure } from "./failure-evidence.ts";
 import { resolveFullAccessArgv, resolveSandboxProjection } from "./sandbox-projection.ts";
 import { isUpstreamFailureText, vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
@@ -88,6 +89,19 @@ export function buildOpenCodeInvocation(req: SpawnRequest): AdapterInvocation {
 }
 
 export function normalizeOpenCodeResult(raw: AdapterRawResult): SpawnResult {
+  const result = normalizeOpenCodeTransportResult(raw);
+  if (result.ok) return result;
+  const parsed = parseOpenCodeStream(raw.stdout);
+  const text = parsed.text || raw.stdout.trim();
+  return {
+    ...result,
+    text,
+    sessionId: parsed.sessionId,
+    failureEvidence: observeSpawnFailure(raw, text, parsed.text ? "vendor_envelope" : "stdout"),
+  };
+}
+
+function normalizeOpenCodeTransportResult(raw: AdapterRawResult): SpawnResult {
   if (raw.timedOut) {
     return {
       ok: false,

package/src/core/workflow/types.ts

@@ -137,11 +137,12 @@ export interface WorkflowAgentProof {
   session_id?: string;
   result?: ResultDigest;
   error?: string;
-  /** Set on a failed agent whose spawn was classified uninformative about the
-   * work (ADR 0046): environment (binary absent) or upstream (vendor refused).
-   * Absent ⇒ a work failure. Recorded even when a script's parallel() swallows
-   * the rejection, so the run-level class can still be derived from proof. */
+  /** Failed-spawn transport class. It is retained even when a script swallows
+   * the rejection; charging additionally requires validated failure evidence. */
   class?: SpawnFailureClass;
+  /** Failure observations carried from the adapter. Missing observations are
+   * unknown and cannot authorize an uncharged attempt. */
+  failure_evidence?: SpawnFailureEvidence;
   /** Which vendor sandbox mode this agent launched with and why (ADR 0192).
    * Absent on a cached agent, which launched nothing. */
   access?: WorkerAccessDecision;
@@ -149,6 +150,9 @@ export interface WorkflowAgentProof {
 
 export interface WorkflowRepoSnapshot {
   cwd: string;
+  observation: "ok" | "unavailable" | "partial";
+  /** Bounded explanation of an unavailable or incomplete observation. */
+  observation_detail?: string;
   root?: string;
   branch?: string;
   head?: string;
@@ -161,12 +165,13 @@ export interface WorkflowRepoEvidence {
   before: WorkflowRepoSnapshot;
   after: WorkflowRepoSnapshot;
   drift: {
-    branch_changed: boolean;
-    head_changed: boolean;
-    dirty_paths_added: string[];
-    dirty_paths_cleared: string[];
-    dirty_paths_retained: string[];
-    /** True when snapshots cannot prove whether every retained dirty path changed. */
+    /** Null means the snapshots do not establish this comparison. */
+    branch_changed: boolean | null;
+    head_changed: boolean | null;
+    dirty_paths_added: string[] | null;
+    dirty_paths_cleared: string[] | null;
+    dirty_paths_retained: string[] | null;
+    /** True when an observation, comparison, or retained-path change is unknown. */
     incomplete: boolean;
     note?: string;
   };
@@ -358,15 +363,16 @@ export interface WorkflowSpecialistProfile {
 }
 
 /**
- * Why a failed run was uninformative about the work (ADR 0046). Absent means
- * the attempt produced information about the work (or succeeded), which is the
- * default and is charged against the attempt budget exactly as before.
+ * The positively identified transport cause of a failed spawn (ADR 0046).
+ * This class alone proves neither absence of effects nor retry eligibility.
  *
  * - `environment`: the run never started — a precondition was missing (the
- *   vendor binary was absent). Uncharged AND not retried: retrying an unchanged
+ *   vendor binary was absent). With positive no-effect/output evidence it is
+ *   uncharged and not retried: retrying an unchanged
  *   environment cannot help, so the work item stops and names the precondition.
  * - `upstream`: the vendor was reached and refused (5xx, 429, circuit open).
- *   Uncharged, but retry stays available (bounded by max_uncharged_attempts).
+ *   Retry/free-attempt eligibility also requires positive no-effect evidence,
+ *   observed absent output, and no refusal. Unsupported evidence stays unknown.
  */
 export type SpawnFailureClass = "environment" | "upstream";
 
@@ -388,6 +394,30 @@ export type SpawnFailureClass = "environment" | "upstream";
  */
 export type RunFailureClass = SpawnFailureClass | "decision";
 
+/** Positive claims name the observation that supports them. A transport error
+ * or an empty reply is never evidence that no effects occurred. */
+export type SpawnEffectEvidence =
+  | { state: "unknown" }
+  | { state: "none"; source: "spawn_errno"; reference: "ENOENT" }
+  | { state: "none" | "observed"; source: "adapter_evidence"; reference: string };
+
+export type SpawnRefusalEvidence =
+  | { state: "unknown" }
+  | { state: "refused"; source: "vendor_envelope"; reference: string };
+
+export type SpawnOutputSource = "final_message" | "vendor_envelope" | "stdout";
+
+export type SpawnPartialOutputEvidence =
+  | { state: "unknown" }
+  | { state: "absent"; source: SpawnOutputSource }
+  | { state: "present"; source: SpawnOutputSource; bytes: number; sha256: string };
+
+export interface SpawnFailureEvidence {
+  effect: SpawnEffectEvidence;
+  refusal: SpawnRefusalEvidence;
+  partial_output: SpawnPartialOutputEvidence;
+}
+
 /** What a spawn adapter returns for one subagent run. */
 export interface SpawnResult {
   ok: boolean;
@@ -399,9 +429,13 @@ export interface SpawnResult {
   durationMs: number;
   /** Populated when ok=false. */
   error?: string;
-  /** Set when ok=false and the failure was positively identified as
-   * uninformative about the work. Absent ⇒ a work failure (charged). */
+  /** Transport classification when ok=false; never sufficient by itself to
+   * grant free work or automatic redispatch. */
   class?: SpawnFailureClass;
+  /** Transport classification alone grants neither a retry nor free work.
+   * Absent evidence is explicitly unknown. Positive adapter_evidence claims
+   * require a documented producer observation, never an HTTP/text heuristic. */
+  failureEvidence?: SpawnFailureEvidence;
 }
 
 export interface SpawnRequest {

package/src/core/workflow/workspaces/index.ts

@@ -36,7 +36,6 @@ export {
   probe as probeLocalGitWorktreeProvider,
 } from "./local-git.ts";
 export type { PrepareReclaimInput, ReclaimMode, ReclaimPreparation } from "./reclaim.ts";
-export { prepareReclaim } from "./reclaim.ts";
 export type {
   AuthorizedIntegrationPlan,
   AuthorizedProviderIntegrationInput,

package/src/core/workflow/workspaces/leases.ts

@@ -39,7 +39,8 @@ export type LeaseRecoveryStep =
   | "claim_created"
   | "stale_pinned"
   | "current_removed"
-  | "new_current_linked";
+  | "new_current_linked"
+  | "recovery_retired";
 
 export interface AcquireNoClobberLeaseInput {
   path: string;
@@ -51,6 +52,8 @@ export interface AcquireNoClobberLeaseInput {
   now?: () => number;
   pid?: number;
   host?: string;
+  /** Probe dependency for deterministic liveness-failure tests. */
+  probePid?: (pid: number) => void;
   /** Fault-injection hook immediately before the lease directory is created. */
   onLeaseDirectoryCreate?: () => void;
   /** Fault-injection hook after contention is observed and before owner inspection. */
@@ -137,8 +140,10 @@ export function acquireNoClobberLease(input: AcquireNoClobberLeaseInput): NoClob
     if (observed === undefined) {
       throw new Error(`lease ${input.scope} changed repeatedly during contention`);
     }
-    if (leaseIsLive(observed.owner, now(), input.staleAfterMs)) {
-      throw new Error(`lease ${input.scope} is held by a live or unexpired owner`);
+    if (leaseIsLive(observed.owner, now(), input.staleAfterMs, input.probePid)) {
+      throw new Error(
+        `lease ${input.scope} is held by a live or unexpired owner, or its liveness is unknown`,
+      );
     }
     if (
       observed.owner.scope !== input.scope ||
@@ -156,7 +161,7 @@ export function acquireNoClobberLease(input: AcquireNoClobberLeaseInput): NoClob
       linkSync(currentPath, pinPath);
       assertSameInodeAndBytes(currentPath, pinPath, observed.bytes);
     } catch {
-      abortUnchangedRecoveryClaim(leaseDir, recoveryPath, pinPath, owner);
+      abortUnchangedRecoveryClaim(leaseDir, recoveryPath, owner);
       recoveryClaimed = false;
       throw new Error(`lease ${input.scope} recovery raced with another contender`);
     }
@@ -174,10 +179,9 @@ export function acquireNoClobberLease(input: AcquireNoClobberLeaseInput): NoClob
     input.onRecoveryStep?.("new_current_linked");
 
     removePinnedOwner(leaseDir, pinPath, observed.owner);
-    unlinkSync(pinPath);
-    unlinkSync(join(recoveryPath, "claim.json"));
-    rmdirSync(recoveryPath);
-    fsyncDirectory(leaseDir);
+    retireRecoveryClaim(leaseDir, recoveryPath, owner, () =>
+      input.onRecoveryStep?.("recovery_retired"),
+    );
     return {
       ...leaseHandle(leaseDir, ownerPath, ownerBytes, owner),
       recovered_owner: observed.owner,
@@ -266,7 +270,7 @@ function reclaimAbandonedRecovery(
   now: number,
 ): void {
   const claim = readRecoveryClaim(recoveryPath);
-  if (leaseIsLive(claim.claimant, now, input.staleAfterMs)) {
+  if (leaseIsLive(claim.claimant, now, input.staleAfterMs, input.probePid)) {
     throw new Error(`lease ${input.scope} recovery is already in progress`);
   }
   if (
@@ -326,16 +330,34 @@ function reclaimAbandonedRecovery(
 function abortUnchangedRecoveryClaim(
   leaseDir: string,
   recoveryPath: string,
-  pinPath: string,
   claimant: NoClobberLeaseOwner,
 ): void {
   const claim = readRecoveryClaim(recoveryPath);
   if (claim.claimant.owner_id !== claimant.owner_id) {
     throw new Error(`lease ${claimant.scope} recovery ownership changed`);
   }
-  safeUnlink(pinPath);
-  unlinkSync(join(recoveryPath, "claim.json"));
-  rmdirSync(recoveryPath);
+  retireRecoveryClaim(leaseDir, recoveryPath, claimant);
+}
+
+/**
+ * Move this claimant's recovery directory to a private name before emptying
+ * it. Renaming a directory onto an existing empty directory replaces it, so
+ * emptying `recovery` in place would let a contender's claim land there and
+ * fail this claimant's final rmdir after it already holds the lease.
+ */
+function retireRecoveryClaim(
+  leaseDir: string,
+  recoveryPath: string,
+  claimant: NoClobberLeaseOwner,
+  onRetired?: () => void,
+): void {
+  const retired = join(leaseDir, `recovery-retired-${claimant.owner_id}`);
+  renameSync(recoveryPath, retired);
+  fsyncDirectory(leaseDir);
+  onRetired?.();
+  safeUnlink(join(retired, "stale-pin"));
+  unlinkSync(join(retired, "claim.json"));
+  rmdirSync(retired);
   fsyncDirectory(leaseDir);
 }
 
@@ -466,7 +488,14 @@ function isStringRecord(value: unknown): value is Record<string, string> {
   );
 }
 
-function leaseIsLive(owner: NoClobberLeaseOwner, now: number, staleAfterMs: number): boolean {
+function leaseIsLive(
+  owner: NoClobberLeaseOwner,
+  now: number,
+  staleAfterMs: number,
+  probePid: (pid: number) => void = (pid) => {
+    process.kill(pid, 0);
+  },
+): boolean {
   const created = Date.parse(owner.created_at);
   const expires = Date.parse(owner.expires_at);
   if (
@@ -478,12 +507,14 @@ function leaseIsLive(owner: NoClobberLeaseOwner, now: number, staleAfterMs: numb
   ) {
     return true;
   }
-  if (owner.host !== hostname()) return false;
+  // Expiry only makes a same-host owner eligible for a process check. Neither
+  // a remote owner nor an unreadable probe proves that its work has stopped.
+  if (owner.host !== hostname()) return true;
   try {
-    process.kill(owner.pid, 0);
+    probePid(owner.pid);
     return true;
   } catch (error) {
-    return (error as NodeJS.ErrnoException).code === "EPERM";
+    return (error as NodeJS.ErrnoException).code !== "ESRCH";
   }
 }