harnery 0.45.1 → 0.45.2

package/src/core/workflow/workspaces/local-git.ts

@@ -7,10 +7,14 @@ import {
   realpathSync,
   writeFileSync,
 } from "node:fs";
+import { hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
-import { beginWorkflowRecovery, validateWorkflowRecoveryAuthorization } from "../recovery-audit.ts";
-import { acquireWorkflowResumeLease } from "../run-state.ts";
+import {
+  acquireWorkflowResumeLease,
+  readWorkflowResumeLock,
+  workflowResumeLockPath,
+} from "../resume-lock.ts";
 import { WorkspaceAttestationError } from "./attestation-error.ts";
 import { cleanupWorkspace } from "./cleanup.ts";
 import {
@@ -24,12 +28,8 @@ import {
   parseWorktreeInventory,
   worktreeInventory,
 } from "./git.ts";
-import { acquireNoClobberLease } from "./leases.ts";
-import {
-  claimOverlapsWorkspace,
-  reserveWorkspaceReclaim,
-  type WorkspaceReclaimReservation,
-} from "./ownership.ts";
+import { acquireNoClobberLease, readOwner } from "./leases.ts";
+import { claimOverlapsWorkspace } from "./ownership.ts";
 import {
   assertContainedExisting,
   assertPathIdentity,
@@ -821,7 +821,6 @@ function reclaimPreview(
     run_id: binding.run_id,
     mode,
     liveness: readWorkflowLiveness(coordRoot, binding.run_id),
-    evidence_sha256: reclaimEvidenceDigest(coordRoot, binding),
     ownership: "unproven",
     dirty_paths: null,
     lease_holder: reclaimLeaseHolders(coordRoot, binding),
@@ -841,42 +840,15 @@ function reclaimPreview(
   return preview;
 }
 
-function reclaimEvidenceDigest(coordRoot: string, binding: WorkspaceBinding): string {
-  const evidence = (name: string): string | null => {
-    try {
-      return readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, name), "utf8");
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-      throw error;
-    }
-  };
-  return stableDigest({
-    binding,
-    proof: evidence("proof.json"),
-    transcript: evidence("transcript.jsonl"),
-  });
-}
-
-function assertReclaimLiveness(
-  coordRoot: string,
-  binding: WorkspaceBinding,
-  recovery?: WorkspaceReclaimOptions["unknownLiveness"],
-): void {
+function assertReclaimLiveness(coordRoot: string, binding: WorkspaceBinding, force = false): void {
   const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-  if (liveness === "active" || (recovery && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
+  if (liveness === "active" || (force && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
     throw new WorkflowReclaimError(
       "workflow_reclaim_run_live",
       `run ${binding.run_id} has active evidence; its workspace was left untouched`,
     );
   }
-  if (recovery && reclaimEvidenceDigest(coordRoot, binding) !== recovery.evidenceSha256) {
-    throw new WorkflowReclaimError(
-      "workflow_reclaim_recovery_mismatch",
-      "workflow reclaim requires the exact current preview evidence digest",
-    );
-  }
-  if (liveness === "inactive") return;
-  if (liveness === "unknown" && recovery) return;
+  if (liveness === "inactive" || force) return;
   throw new WorkflowReclaimError(
     "workflow_reclaim_liveness_unknown",
     `run ${binding.run_id} has missing, corrupt, or ambiguous liveness evidence; its workspace was left untouched`,
@@ -907,7 +879,7 @@ function assertPeerWorkspaceAuthority(coordRoot: string, claim: WorkspaceClaim):
         throw new Error("retained peer binding authority is missing");
       }
       if (!claimOverlapsWorkspace(peer, claim.workspace_root)) continue;
-      // Process termination, archival and an expired reservation do not release
+      // Process termination, archival and an expired lease do not release
       // a resource. Require the provider's release record AND current absence.
       if (binding && events.some((event) => event.event === "released")) {
         const current = attestSync(coordRoot, binding);
@@ -920,24 +892,6 @@ function assertPeerWorkspaceAuthority(coordRoot: string, claim: WorkspaceClaim):
   }
 }
 
-function reclaimAuthorityGuard(
-  coordRoot: string,
-  binding: WorkspaceBinding,
-  claim: WorkspaceClaim,
-  reservation: WorkspaceReclaimReservation,
-  recovery?: WorkspaceReclaimOptions["unknownLiveness"],
-): void {
-  try {
-    reservation.assertCurrent();
-    assertReclaimLiveness(coordRoot, binding, recovery);
-    assertReclaimOwnership(coordRoot, binding);
-    assertPeerWorkspaceAuthority(coordRoot, claim);
-  } catch (error) {
-    if (error instanceof WorkflowReclaimError) throw error;
-    throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", (error as Error).message);
-  }
-}
-
 async function reclaim(
   coordRoot: string,
   provider: WorkspaceProvider,
@@ -948,179 +902,107 @@ async function reclaim(
     throw new Error("unsupported workspace reclaim mode");
   }
   if (!options.yes) return reclaimPreview(coordRoot, binding, options.mode);
-  if (options.unknownLiveness) validateWorkflowRecoveryAuthorization(options.unknownLiveness);
 
-  // Liveness comes before terminal-proof cleanup helpers. A live run may not
-  // have a proof yet, and a missing proof must never be discovered after reset.
-  assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
+  // Liveness comes before leases and terminal-proof cleanup helpers. A live run
+  // may not have a proof yet, and a missing proof must never be found after reset.
+  assertReclaimLiveness(coordRoot, binding, options.force);
   const claim = assertReclaimOwnership(coordRoot, binding);
-  let reservation: WorkspaceReclaimReservation;
-  try {
-    reservation = reserveWorkspaceReclaim(coordRoot, claim);
-  } catch (error) {
-    throw new WorkflowReclaimError("workflow_reclaim_lease_held", (error as Error).message);
-  }
-  try {
-    reclaimAuthorityGuard(coordRoot, binding, claim, reservation, options.unknownLiveness);
-    let releaseResume: () => void;
+  assertPeerWorkspaceAuthority(coordRoot, claim);
+  const releases: Array<() => void> = [];
+  const hold = (acquire: () => () => void) => {
     try {
-      releaseResume = acquireWorkflowResumeLease(coordRoot, binding.run_id);
+      releases.unshift(acquire());
     } catch (error) {
       throw new WorkflowReclaimError("workflow_reclaim_lease_held", (error as Error).message);
     }
-    try {
-      let releaseBinding: () => void;
-      try {
-        releaseBinding = acquireLease(
-          coordRoot,
-          workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id),
-          claim,
-          "binding",
-        );
-      } catch (error) {
-        throw new WorkflowReclaimError("workflow_reclaim_lease_held", (error as Error).message);
-      }
-      try {
-        let releaseRepository: () => void;
-        try {
-          releaseRepository = acquireRepositoryLease(coordRoot, claim);
-        } catch (error) {
-          throw new WorkflowReclaimError("workflow_reclaim_lease_held", (error as Error).message);
-        }
-        try {
-          assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
-          assertReclaimOwnership(coordRoot, binding);
-          const preview = reclaimPreview(coordRoot, binding, options.mode);
-          const audit = options.unknownLiveness
-            ? beginWorkflowRecovery(coordRoot, {
-                run_id: binding.run_id,
-                action: "reclaim_unknown_liveness",
-                actor: options.unknownLiveness.actor,
-                reason: options.unknownLiveness.reason,
-                target_sha256: options.unknownLiveness.evidenceSha256,
-                target: {
-                  binding_id: binding.binding_id,
-                  workspace_root: binding.workspace_root,
-                  mode: options.mode,
-                  liveness: preview.liveness,
-                },
-              })
-            : undefined;
-          let preparation: ReclaimPreparation | undefined;
-          // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
-          // Its provider callback uses the leases already held here instead of
-          // trying to acquire them again. Preparation occurs only after all of
-          // cleanup's path, ownership, ref and registration checks have succeeded.
-          const cleanupResult = await cleanupWorkspace({
-            coordRoot,
-            runId: binding.run_id,
-            provider: {
-              ...provider,
-              cleanup: async (candidate, intent) => {
-                assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
-                assertReclaimOwnership(coordRoot, candidate);
-                return cleanupUnderLease(coordRoot, candidate, claim, intent, {
-                  mode: options.mode,
-                  recovery: options.unknownLiveness,
-                  beforeEffect: () => {
-                    audit?.assertCurrent();
-                    reclaimAuthorityGuard(
-                      coordRoot,
-                      candidate,
-                      claim,
-                      reservation,
-                      options.unknownLiveness,
-                    );
-                  },
-                  beforeRefEffect: () => {
-                    audit?.assertCurrent();
-                    reservation.assertCurrent();
-                    assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
-                    requiredClaim(coordRoot, candidate);
-                    assertPeerWorkspaceAuthority(coordRoot, claim);
-                  },
-                  prepared: (value) => {
-                    preparation = value;
-                  },
-                });
-              },
-            },
-          });
-          if (
-            !preparation &&
-            cleanupResult.status !== "released" &&
-            cleanupResult.status !== "already_released"
-          ) {
-            throw new WorkflowReclaimError(
-              "workflow_reclaim_ownership_unproven",
-              ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
-                "workspace cleanup preconditions could not be proved",
-            );
-          }
-          if (cleanupResult.status === "released" || cleanupResult.status === "already_released")
-            audit?.complete();
-          return {
-            ...preview,
-            action: "reclaimed",
-            lease_holder: [],
-            preparation: preparation ?? {
-              action: "already_gone",
-              detail: "the workspace is already released",
+  };
+  try {
+    hold(() => acquireWorkflowResumeLease(coordRoot, binding.run_id));
+    hold(() =>
+      acquireLease(
+        coordRoot,
+        workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id),
+        claim,
+        "binding",
+      ),
+    );
+    hold(() => acquireRepositoryLease(coordRoot, claim));
+    const preview = reclaimPreview(coordRoot, binding, options.mode);
+    if (options.force && preview.liveness !== "inactive") {
+      appendWorkspaceEvent(coordRoot, claim, "reclaim_forced", {
+        run_id: binding.run_id,
+        mode: options.mode,
+        liveness: preview.liveness,
+        pid: process.pid,
+        host: hostname(),
+      });
+    }
+    let preparation: ReclaimPreparation | undefined;
+    // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
+    // Its provider callback uses the leases already held here. Preparation
+    // occurs only after cleanup's liveness, ownership, path, ref and
+    // registration checks have succeeded under those leases.
+    const cleanupResult = await cleanupWorkspace({
+      coordRoot,
+      runId: binding.run_id,
+      provider: {
+        ...provider,
+        cleanup: async (candidate, intent) =>
+          cleanupUnderLease(coordRoot, candidate, claim, intent, {
+            mode: options.mode,
+            force: options.force,
+            prepared: (value) => {
+              preparation = value;
             },
-            cleanup: cleanupResult,
-          };
-        } finally {
-          releaseRepository();
-        }
-      } finally {
-        releaseBinding();
-      }
-    } finally {
-      releaseResume();
+          }),
+      },
+    });
+    if (
+      !preparation &&
+      cleanupResult.status !== "released" &&
+      cleanupResult.status !== "already_released"
+    ) {
+      throw new WorkflowReclaimError(
+        "workflow_reclaim_ownership_unproven",
+        ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
+          "workspace cleanup preconditions could not be proved",
+      );
     }
+    return {
+      ...preview,
+      action: "reclaimed",
+      lease_holder: [],
+      preparation: preparation ?? {
+        action: "already_gone",
+        detail: "the workspace is already released",
+      },
+      cleanup: cleanupResult,
+    };
   } finally {
-    reservation.release();
+    for (const release of releases) release();
   }
 }
 
 function reclaimLeaseHolders(coordRoot: string, binding: WorkspaceBinding): ReclaimLeaseHolder[] {
-  const paths: Array<[ReclaimLeaseHolder["scope"], string]> = [
+  const holders: ReclaimLeaseHolder[] = [];
+  if (existsSync(workflowResumeLockPath(coordRoot, binding.run_id))) {
+    const owner = readWorkflowResumeLock(coordRoot, binding.run_id);
+    holders.push(
+      owner
+        ? { scope: "resume", pid: owner.pid, host: owner.host }
+        : { scope: "resume", detail: "lease holder could not be read" },
+    );
+  }
+  const leases: Array<[ReclaimLeaseHolder["scope"], string]> = [
     ["binding", workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id)],
   ];
   if (binding.repository) {
-    const key = stableDigest({ common: binding.repository.common_dir.identity });
-    paths.push([
-      "repository",
-      join(coordRoot, ".harnery", "workspaces", PROVIDER_ID, ".leases", `repository-${key}.lock`),
-    ]);
-  }
-  const holders: ReclaimLeaseHolder[] = [];
-  try {
-    const owner = JSON.parse(
-      readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, "resume.lock"), "utf8"),
-    ) as Record<string, unknown>;
-    holders.push({
-      scope: "resume",
-      pid: typeof owner.pid === "number" ? owner.pid : undefined,
-      host: typeof owner.host === "string" ? owner.host : undefined,
-    });
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
-      holders.push({ scope: "resume", detail: "lease holder could not be read" });
-    }
+    leases.push(["repository", repositoryLeasePath(coordRoot, binding.repository)]);
   }
-  for (const [scope, path] of paths) {
+  for (const [scope, path] of leases) {
     try {
-      const owner = JSON.parse(readFileSync(join(path, "current"), "utf8")) as Record<
-        string,
-        unknown
-      >;
-      holders.push({
-        scope,
-        owner_id: typeof owner.owner_id === "string" ? owner.owner_id : undefined,
-        pid: typeof owner.pid === "number" ? owner.pid : undefined,
-        host: typeof owner.host === "string" ? owner.host : undefined,
-      });
+      const { owner } = readOwner(join(path, "current"));
+      holders.push({ scope, owner_id: owner.owner_id, pid: owner.pid, host: owner.host });
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
         holders.push({ scope, detail: "lease holder could not be read" });
@@ -1146,17 +1028,7 @@ async function cleanup(
   try {
     const releaseRepository = acquireRepositoryLease(coordRoot, claim);
     try {
-      const reservation = reserveWorkspaceReclaim(coordRoot, claim);
-      try {
-        const authorityGuard = () => {
-          reservation.assertCurrent();
-          assertPeerWorkspaceAuthority(coordRoot, claim);
-        };
-        authorityGuard();
-        return cleanupUnderLease(coordRoot, binding, claim, intent, undefined, authorityGuard);
-      } finally {
-        reservation.release();
-      }
+      return cleanupUnderLease(coordRoot, binding, claim, intent);
     } finally {
       releaseRepository();
     }
@@ -1172,12 +1044,9 @@ function cleanupUnderLease(
   intent: WorkspaceCleanupIntent,
   reclaimRequest?: {
     mode: ReclaimMode;
-    recovery?: WorkspaceReclaimOptions["unknownLiveness"];
-    beforeEffect: () => void;
-    beforeRefEffect: () => void;
+    force?: boolean;
     prepared: (value: ReclaimPreparation) => void;
   },
-  beforeRemoval?: () => void,
 ): WorkspaceCleanupResult {
   const repository = binding.repository;
   if (
@@ -1222,7 +1091,7 @@ function cleanupUnderLease(
     };
   }
   const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-  if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.recovery)) {
+  if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.force)) {
     return {
       ...base,
       status: "blocked",
@@ -1315,15 +1184,15 @@ function cleanupUnderLease(
   }
 
   if (reclaimRequest) {
-    assertReclaimLiveness(coordRoot, binding, reclaimRequest.recovery);
-    assertReclaimOwnership(coordRoot, binding);
+    // The last liveness check before a destructive reset.
+    assertReclaimLiveness(coordRoot, binding, reclaimRequest.force);
     revalidateClaimResources(claim, root);
     reclaimRequest.prepared(
       prepareReclaim({
         worktreePath: binding.workspace_root,
         mode: reclaimRequest.mode,
         runId: binding.run_id,
-        beforeEffect: reclaimRequest.beforeEffect,
+        beforeEffect: () => assertPeerWorkspaceAuthority(coordRoot, claim),
       }),
     );
   }
@@ -1336,8 +1205,7 @@ function cleanupUnderLease(
     target_ref_oid: targetRef.out,
   });
   if (before.workspace_exists) {
-    reclaimRequest?.beforeEffect();
-    beforeRemoval?.();
+    assertPeerWorkspaceAuthority(coordRoot, claim);
     revalidateClaimResources(claim, root);
     assertContainedExisting(root, binding.workspace_root, "workspace cleanup path");
     git(repository.source_root.realpath, ["worktree", "remove", binding.workspace_root]);
@@ -1363,7 +1231,6 @@ function cleanupUnderLease(
       return { ...base, status: "blocked", reason: "workspace ref changed during cleanup" };
     }
     revalidateClaimResources(claim, root);
-    reclaimRequest?.beforeRefEffect();
     const deleted = gitMaybe(repository.source_root.realpath, [
       "update-ref",
       "-d",
@@ -2288,9 +2155,24 @@ function capabilityDigestForClaim(claim: WorkspaceClaim): string {
   return stableDigest(basis);
 }
 
+function repositoryLeasePath(
+  coordRoot: string,
+  repository: { common_dir: { identity: FilesystemIdentity } },
+): string {
+  const key = stableDigest({ common: repository.common_dir.identity });
+  return join(
+    resolve(coordRoot),
+    ".harnery",
+    "workspaces",
+    PROVIDER_ID,
+    ".leases",
+    `repository-${key}.lock`,
+  );
+}
+
 function acquireRepositoryLease(coordRoot: string, claim: WorkspaceClaim): () => void {
-  const leaseDir = join(resolve(coordRoot), ".harnery", "workspaces", PROVIDER_ID, ".leases");
-  mkdirSync(leaseDir, { recursive: true, mode: stateDirMode() });
+  const path = repositoryLeasePath(coordRoot, claim.repository);
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   // Mutual exclusion keys on the Git common directory alone. `git worktree add`,
   // `prune`, and the shared-`config` migration all write to the common directory's
   // administrative area, and once worktrees and submodules are allowed, several
@@ -2299,8 +2181,7 @@ function acquireRepositoryLease(coordRoot: string, claim: WorkspaceClaim): () =>
   // nested — writable roots. Including the writable root in the key would hand those
   // agents different locks and let their admin-area writes race. The writable root
   // stays in the lease metadata for diagnostics, not in the exclusion key.
-  const key = stableDigest({ common: claim.repository.common_dir.identity });
-  return acquireLease(coordRoot, join(leaseDir, `repository-${key}.lock`), claim, "repository");
+  return acquireLease(coordRoot, path, claim, "repository");
 }
 
 function acquireLease(

package/src/core/workflow/workspaces/ownership.ts

@@ -1,165 +1,10 @@
-import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { readJsonRecord, stableDigest } from "../durable-record.ts";
-import { acquireNoClobberLease, type NoClobberLease } from "./leases.ts";
+import { lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { stableDigest } from "../durable-record.ts";
 import { containsPath } from "./paths.ts";
 import type { WorkspaceClaim } from "./state.ts";
 import { isWorkspaceAllocationRequest } from "./validate.ts";
 
-const STALE_MS = 5 * 60 * 1_000;
-const RESERVATION_SCOPE = "workspace-reclaim";
-
-function leaseRoot(coordRoot: string, providerId: string): string {
-  return join(resolve(coordRoot), ".harnery", "workspaces", providerId, ".leases");
-}
-
-/** Serialize only publication and reservation registration, never Git work. */
-function withPublicationGate<T>(coordRoot: string, providerId: string, operation: () => T): T {
-  const authority = stableDigest({ provider_id: providerId, scope: "workspace-publication" });
-  const gate = acquireNoClobberLease({
-    path: join(leaseRoot(coordRoot, providerId), "publication.lock"),
-    scope: "workspace-publication",
-    authoritySha256: authority,
-    staleAfterMs: STALE_MS,
-    validateStaleOwner: (owner) => owner.authority_sha256 === authority,
-  });
-  try {
-    return operation();
-  } finally {
-    gate.release();
-  }
-}
-
-function reservationPath(coordRoot: string, claim: WorkspaceClaim): string {
-  return join(leaseRoot(coordRoot, claim.provider_id), `reclaim-${claim.binding_id}.lock`);
-}
-
-function acquireReservation(coordRoot: string, claim: WorkspaceClaim): NoClobberLease {
-  const authority = stableDigest(claim);
-  return acquireNoClobberLease({
-    path: reservationPath(coordRoot, claim),
-    scope: RESERVATION_SCOPE,
-    authoritySha256: authority,
-    staleAfterMs: STALE_MS,
-    metadata: { binding_id: claim.binding_id, request_sha256: claim.request_sha256 },
-    validateStaleOwner: (owner) =>
-      owner.authority_sha256 === authority &&
-      owner.metadata?.binding_id === claim.binding_id &&
-      owner.metadata?.request_sha256 === claim.request_sha256,
-  });
-}
-
-export interface WorkspaceReclaimReservation {
-  assertCurrent(): void;
-  release(): void;
-}
-
-/** The immutable claim is the authority; the lease reserves its destructive path. */
-export function reserveWorkspaceReclaim(
-  coordRoot: string,
-  claim: WorkspaceClaim,
-): WorkspaceReclaimReservation {
-  assertClaimAuthority(claim, claim.provider_id, claim.binding_id);
-  const lease = withPublicationGate(coordRoot, claim.provider_id, () =>
-    acquireReservation(coordRoot, claim),
-  );
-  return {
-    assertCurrent() {
-      const path = reservationPath(coordRoot, claim);
-      const current = join(path, "current");
-      const pin = join(path, lease.owner.owner_file);
-      const a = lstatSync(current, { bigint: true });
-      const b = lstatSync(pin, { bigint: true });
-      if (
-        !a.isFile() ||
-        !b.isFile() ||
-        a.dev !== b.dev ||
-        a.ino !== b.ino ||
-        readFileSync(current, "utf8") !== readFileSync(pin, "utf8") ||
-        stableDigest(readJsonRecord(current, "reclaim reservation")) !== stableDigest(lease.owner)
-      ) {
-        throw new Error("workspace reclaim reservation owner changed");
-      }
-      const persisted = readJsonRecord<WorkspaceClaim>(
-        join(dirname(dirname(path)), claim.binding_id, "claim.json"),
-        "reserved workspace claim",
-      );
-      if (stableDigest(persisted) !== stableDigest(claim)) {
-        throw new Error("workspace reclaim reservation claim changed");
-      }
-    },
-    release: () => lease.release(),
-  };
-}
-
-export function publishWorkspaceClaim<T>(
-  coordRoot: string,
-  claim: WorkspaceClaim,
-  publish: () => T,
-): T {
-  assertClaimAuthority(claim, claim.provider_id, claim.binding_id);
-  return withPublicationGate(coordRoot, claim.provider_id, () => {
-    for (const entry of readdirSync(leaseRoot(coordRoot, claim.provider_id), {
-      withFileTypes: true,
-    })) {
-      if (!entry.name.startsWith("reclaim-") || !entry.name.endsWith(".lock")) continue;
-      if (!entry.isDirectory()) throw new Error("workspace reclaim reservation is not a directory");
-      const path = join(leaseRoot(coordRoot, claim.provider_id), entry.name);
-      const current = join(path, "current");
-      try {
-        lstatSync(current);
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
-        throw error;
-      }
-      const id = entry.name.slice("reclaim-".length, -".lock".length);
-      const reserved = readJsonRecord<WorkspaceClaim>(
-        join(dirname(leaseRoot(coordRoot, claim.provider_id)), id, "claim.json"),
-        "reserved workspace claim",
-      );
-      assertClaimAuthority(reserved, claim.provider_id, id);
-      // Unknown reservation authority is never interpreted as an unrelated owner.
-      const owner = readJsonRecord<NoClobberLease["owner"]>(current, "reclaim reservation");
-      if (
-        owner.schema_version !== 1 ||
-        typeof owner.owner_id !== "string" ||
-        !/^[a-f0-9-]{36}$/.test(owner.owner_id) ||
-        owner.owner_file !== `owner-${owner.owner_id}.json` ||
-        !Number.isSafeInteger(owner.pid) ||
-        owner.pid <= 0 ||
-        typeof owner.host !== "string" ||
-        owner.host.length === 0 ||
-        !Number.isFinite(Date.parse(owner.created_at)) ||
-        !Number.isFinite(Date.parse(owner.expires_at)) ||
-        Date.parse(owner.expires_at) < Date.parse(owner.created_at) ||
-        owner.scope !== RESERVATION_SCOPE ||
-        owner.authority_sha256 !== stableDigest(reserved) ||
-        owner.metadata?.binding_id !== id ||
-        owner.metadata?.request_sha256 !== reserved.request_sha256
-      ) {
-        throw new Error("workspace reclaim reservation authority is unproven");
-      }
-      const a = lstatSync(current, { bigint: true });
-      const pin = join(path, owner.owner_file);
-      const b = lstatSync(pin, { bigint: true });
-      if (
-        !a.isFile() ||
-        !b.isFile() ||
-        a.dev !== b.dev ||
-        a.ino !== b.ino ||
-        readFileSync(current, "utf8") !== readFileSync(pin, "utf8")
-      )
-        throw new Error("workspace reclaim reservation owner is unproven");
-      if (!claimOverlapsWorkspace(claim, reserved.workspace_root)) continue;
-      // This succeeds only for an expired, provably dead, exact prior owner.
-      // It retires the reservation, never the immutable claim or resource.
-      const recovered = acquireReservation(coordRoot, reserved);
-      recovered.release();
-    }
-    return publish();
-  });
-}
-
 export function assertClaimAuthority(claim: WorkspaceClaim, providerId: string, id: string): void {
   if (
     claim?.schema_version !== 1 ||