harnery 0.45.1 → 0.45.2

package/dist/core/workflow/workspaces/local-git.js

@@ -1,14 +1,14 @@
 import { randomBytes } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.js";
-import { beginWorkflowRecovery, validateWorkflowRecoveryAuthorization } from "../recovery-audit.js";
-import { acquireWorkflowResumeLease } from "../run-state.js";
+import { acquireWorkflowResumeLease, readWorkflowResumeLock, workflowResumeLockPath, } from "../resume-lock.js";
 import { WorkspaceAttestationError } from "./attestation-error.js";
 import { cleanupWorkspace } from "./cleanup.js";
 import { git, gitMaybe, gitMaybeWithDirectoryDescriptor, gitOperations, isAncestor, nulEntries, overwriteRiskPaths, parseWorktreeInventory, worktreeInventory, } from "./git.js";
-import { acquireNoClobberLease } from "./leases.js";
-import { claimOverlapsWorkspace, reserveWorkspaceReclaim, } from "./ownership.js";
+import { acquireNoClobberLease, readOwner } from "./leases.js";
+import { claimOverlapsWorkspace } from "./ownership.js";
 import { assertContainedExisting, assertPathIdentity, candidateUnderRoot, containsPath, createContainedDirectories, descriptorBackedPathsSupported, descriptorPath, filesystemIdentity, openContainedDirectory, sameFilesystemIdentity, validateConfiguredRoot, } from "./paths.js";
 import { prepareReclaim, WorkflowReclaimError, } from "./reclaim.js";
 import { hasActiveWorkflowEvidence, readWorkflowLiveness } from "./recovery.js";
@@ -598,7 +598,6 @@ function reclaimPreview(coordRoot, binding, mode) {
         run_id: binding.run_id,
         mode,
         liveness: readWorkflowLiveness(coordRoot, binding.run_id),
-        evidence_sha256: reclaimEvidenceDigest(coordRoot, binding),
         ownership: "unproven",
         dirty_paths: null,
         lease_holder: reclaimLeaseHolders(coordRoot, binding),
@@ -619,34 +618,12 @@ function reclaimPreview(coordRoot, binding, mode) {
     }
     return preview;
 }
-function reclaimEvidenceDigest(coordRoot, binding) {
-    const evidence = (name) => {
-        try {
-            return readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, name), "utf8");
-        }
-        catch (error) {
-            if (error.code === "ENOENT")
-                return null;
-            throw error;
-        }
-    };
-    return stableDigest({
-        binding,
-        proof: evidence("proof.json"),
-        transcript: evidence("transcript.jsonl"),
-    });
-}
-function assertReclaimLiveness(coordRoot, binding, recovery) {
+function assertReclaimLiveness(coordRoot, binding, force = false) {
     const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-    if (liveness === "active" || (recovery && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
+    if (liveness === "active" || (force && hasActiveWorkflowEvidence(coordRoot, binding.run_id))) {
         throw new WorkflowReclaimError("workflow_reclaim_run_live", `run ${binding.run_id} has active evidence; its workspace was left untouched`);
     }
-    if (recovery && reclaimEvidenceDigest(coordRoot, binding) !== recovery.evidenceSha256) {
-        throw new WorkflowReclaimError("workflow_reclaim_recovery_mismatch", "workflow reclaim requires the exact current preview evidence digest");
-    }
-    if (liveness === "inactive")
-        return;
-    if (liveness === "unknown" && recovery)
+    if (liveness === "inactive" || force)
         return;
     throw new WorkflowReclaimError("workflow_reclaim_liveness_unknown", `run ${binding.run_id} has missing, corrupt, or ambiguous liveness evidence; its workspace was left untouched`);
 }
@@ -677,7 +654,7 @@ function assertPeerWorkspaceAuthority(coordRoot, claim) {
             }
             if (!claimOverlapsWorkspace(peer, claim.workspace_root))
                 continue;
-            // Process termination, archival and an expired reservation do not release
+            // Process termination, archival and an expired lease do not release
             // a resource. Require the provider's release record AND current absence.
             if (binding && events.some((event) => event.event === "released")) {
                 const current = attestSync(coordRoot, binding);
@@ -691,185 +668,99 @@ function assertPeerWorkspaceAuthority(coordRoot, claim) {
         throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
     }
 }
-function reclaimAuthorityGuard(coordRoot, binding, claim, reservation, recovery) {
-    try {
-        reservation.assertCurrent();
-        assertReclaimLiveness(coordRoot, binding, recovery);
-        assertReclaimOwnership(coordRoot, binding);
-        assertPeerWorkspaceAuthority(coordRoot, claim);
-    }
-    catch (error) {
-        if (error instanceof WorkflowReclaimError)
-            throw error;
-        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", error.message);
-    }
-}
 async function reclaim(coordRoot, provider, binding, options) {
     if (options.mode !== "salvage" && options.mode !== "discard") {
         throw new Error("unsupported workspace reclaim mode");
     }
     if (!options.yes)
         return reclaimPreview(coordRoot, binding, options.mode);
-    if (options.unknownLiveness)
-        validateWorkflowRecoveryAuthorization(options.unknownLiveness);
-    // Liveness comes before terminal-proof cleanup helpers. A live run may not
-    // have a proof yet, and a missing proof must never be discovered after reset.
-    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
+    // Liveness comes before leases and terminal-proof cleanup helpers. A live run
+    // may not have a proof yet, and a missing proof must never be found after reset.
+    assertReclaimLiveness(coordRoot, binding, options.force);
     const claim = assertReclaimOwnership(coordRoot, binding);
-    let reservation;
-    try {
-        reservation = reserveWorkspaceReclaim(coordRoot, claim);
-    }
-    catch (error) {
-        throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
-    }
-    try {
-        reclaimAuthorityGuard(coordRoot, binding, claim, reservation, options.unknownLiveness);
-        let releaseResume;
+    assertPeerWorkspaceAuthority(coordRoot, claim);
+    const releases = [];
+    const hold = (acquire) => {
         try {
-            releaseResume = acquireWorkflowResumeLease(coordRoot, binding.run_id);
+            releases.unshift(acquire());
         }
         catch (error) {
             throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
         }
-        try {
-            let releaseBinding;
-            try {
-                releaseBinding = acquireLease(coordRoot, workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id), claim, "binding");
-            }
-            catch (error) {
-                throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
-            }
-            try {
-                let releaseRepository;
-                try {
-                    releaseRepository = acquireRepositoryLease(coordRoot, claim);
-                }
-                catch (error) {
-                    throw new WorkflowReclaimError("workflow_reclaim_lease_held", error.message);
-                }
-                try {
-                    assertReclaimLiveness(coordRoot, binding, options.unknownLiveness);
-                    assertReclaimOwnership(coordRoot, binding);
-                    const preview = reclaimPreview(coordRoot, binding, options.mode);
-                    const audit = options.unknownLiveness
-                        ? beginWorkflowRecovery(coordRoot, {
-                            run_id: binding.run_id,
-                            action: "reclaim_unknown_liveness",
-                            actor: options.unknownLiveness.actor,
-                            reason: options.unknownLiveness.reason,
-                            target_sha256: options.unknownLiveness.evidenceSha256,
-                            target: {
-                                binding_id: binding.binding_id,
-                                workspace_root: binding.workspace_root,
-                                mode: options.mode,
-                                liveness: preview.liveness,
-                            },
-                        })
-                        : undefined;
-                    let preparation;
-                    // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
-                    // Its provider callback uses the leases already held here instead of
-                    // trying to acquire them again. Preparation occurs only after all of
-                    // cleanup's path, ownership, ref and registration checks have succeeded.
-                    const cleanupResult = await cleanupWorkspace({
-                        coordRoot,
-                        runId: binding.run_id,
-                        provider: {
-                            ...provider,
-                            cleanup: async (candidate, intent) => {
-                                assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
-                                assertReclaimOwnership(coordRoot, candidate);
-                                return cleanupUnderLease(coordRoot, candidate, claim, intent, {
-                                    mode: options.mode,
-                                    recovery: options.unknownLiveness,
-                                    beforeEffect: () => {
-                                        audit?.assertCurrent();
-                                        reclaimAuthorityGuard(coordRoot, candidate, claim, reservation, options.unknownLiveness);
-                                    },
-                                    beforeRefEffect: () => {
-                                        audit?.assertCurrent();
-                                        reservation.assertCurrent();
-                                        assertReclaimLiveness(coordRoot, candidate, options.unknownLiveness);
-                                        requiredClaim(coordRoot, candidate);
-                                        assertPeerWorkspaceAuthority(coordRoot, claim);
-                                    },
-                                    prepared: (value) => {
-                                        preparation = value;
-                                    },
-                                });
-                            },
-                        },
-                    });
-                    if (!preparation &&
-                        cleanupResult.status !== "released" &&
-                        cleanupResult.status !== "already_released") {
-                        throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
-                            "workspace cleanup preconditions could not be proved");
-                    }
-                    if (cleanupResult.status === "released" || cleanupResult.status === "already_released")
-                        audit?.complete();
-                    return {
-                        ...preview,
-                        action: "reclaimed",
-                        lease_holder: [],
-                        preparation: preparation ?? {
-                            action: "already_gone",
-                            detail: "the workspace is already released",
-                        },
-                        cleanup: cleanupResult,
-                    };
-                }
-                finally {
-                    releaseRepository();
-                }
-            }
-            finally {
-                releaseBinding();
-            }
+    };
+    try {
+        hold(() => acquireWorkflowResumeLease(coordRoot, binding.run_id));
+        hold(() => acquireLease(coordRoot, workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id), claim, "binding"));
+        hold(() => acquireRepositoryLease(coordRoot, claim));
+        const preview = reclaimPreview(coordRoot, binding, options.mode);
+        if (options.force && preview.liveness !== "inactive") {
+            appendWorkspaceEvent(coordRoot, claim, "reclaim_forced", {
+                run_id: binding.run_id,
+                mode: options.mode,
+                liveness: preview.liveness,
+                pid: process.pid,
+                host: hostname(),
+            });
         }
-        finally {
-            releaseResume();
+        let preparation;
+        // Keep ordinary cleanup's terminal-evidence checks, intent and receipts.
+        // Its provider callback uses the leases already held here. Preparation
+        // occurs only after cleanup's liveness, ownership, path, ref and
+        // registration checks have succeeded under those leases.
+        const cleanupResult = await cleanupWorkspace({
+            coordRoot,
+            runId: binding.run_id,
+            provider: {
+                ...provider,
+                cleanup: async (candidate, intent) => cleanupUnderLease(coordRoot, candidate, claim, intent, {
+                    mode: options.mode,
+                    force: options.force,
+                    prepared: (value) => {
+                        preparation = value;
+                    },
+                }),
+            },
+        });
+        if (!preparation &&
+            cleanupResult.status !== "released" &&
+            cleanupResult.status !== "already_released") {
+            throw new WorkflowReclaimError("workflow_reclaim_ownership_unproven", ("reason" in cleanupResult ? cleanupResult.reason : undefined) ??
+                "workspace cleanup preconditions could not be proved");
         }
+        return {
+            ...preview,
+            action: "reclaimed",
+            lease_holder: [],
+            preparation: preparation ?? {
+                action: "already_gone",
+                detail: "the workspace is already released",
+            },
+            cleanup: cleanupResult,
+        };
     }
     finally {
-        reservation.release();
+        for (const release of releases)
+            release();
     }
 }
 function reclaimLeaseHolders(coordRoot, binding) {
-    const paths = [
+    const holders = [];
+    if (existsSync(workflowResumeLockPath(coordRoot, binding.run_id))) {
+        const owner = readWorkflowResumeLock(coordRoot, binding.run_id);
+        holders.push(owner
+            ? { scope: "resume", pid: owner.pid, host: owner.host }
+            : { scope: "resume", detail: "lease holder could not be read" });
+    }
+    const leases = [
         ["binding", workspaceLockPath(coordRoot, PROVIDER_ID, binding.binding_id)],
     ];
     if (binding.repository) {
-        const key = stableDigest({ common: binding.repository.common_dir.identity });
-        paths.push([
-            "repository",
-            join(coordRoot, ".harnery", "workspaces", PROVIDER_ID, ".leases", `repository-${key}.lock`),
-        ]);
-    }
-    const holders = [];
-    try {
-        const owner = JSON.parse(readFileSync(join(coordRoot, ".harnery", "workflows", binding.run_id, "resume.lock"), "utf8"));
-        holders.push({
-            scope: "resume",
-            pid: typeof owner.pid === "number" ? owner.pid : undefined,
-            host: typeof owner.host === "string" ? owner.host : undefined,
-        });
-    }
-    catch (error) {
-        if (error.code !== "ENOENT") {
-            holders.push({ scope: "resume", detail: "lease holder could not be read" });
-        }
+        leases.push(["repository", repositoryLeasePath(coordRoot, binding.repository)]);
     }
-    for (const [scope, path] of paths) {
+    for (const [scope, path] of leases) {
         try {
-            const owner = JSON.parse(readFileSync(join(path, "current"), "utf8"));
-            holders.push({
-                scope,
-                owner_id: typeof owner.owner_id === "string" ? owner.owner_id : undefined,
-                pid: typeof owner.pid === "number" ? owner.pid : undefined,
-                host: typeof owner.host === "string" ? owner.host : undefined,
-            });
+            const { owner } = readOwner(join(path, "current"));
+            holders.push({ scope, owner_id: owner.owner_id, pid: owner.pid, host: owner.host });
         }
         catch (error) {
             if (error.code !== "ENOENT") {
@@ -887,18 +778,7 @@ async function cleanup(coordRoot, binding, intent) {
     try {
         const releaseRepository = acquireRepositoryLease(coordRoot, claim);
         try {
-            const reservation = reserveWorkspaceReclaim(coordRoot, claim);
-            try {
-                const authorityGuard = () => {
-                    reservation.assertCurrent();
-                    assertPeerWorkspaceAuthority(coordRoot, claim);
-                };
-                authorityGuard();
-                return cleanupUnderLease(coordRoot, binding, claim, intent, undefined, authorityGuard);
-            }
-            finally {
-                reservation.release();
-            }
+            return cleanupUnderLease(coordRoot, binding, claim, intent);
         }
         finally {
             releaseRepository();
@@ -908,7 +788,7 @@ async function cleanup(coordRoot, binding, intent) {
         releaseBinding();
     }
 }
-function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, beforeRemoval) {
+function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest) {
     const repository = binding.repository;
     if (!repository ||
         intent.schema_version !== 1 ||
@@ -946,7 +826,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
         };
     }
     const liveness = readWorkflowLiveness(coordRoot, binding.run_id);
-    if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.recovery)) {
+    if (liveness !== "inactive" && !(liveness === "unknown" && reclaimRequest?.force)) {
         return {
             ...base,
             status: "blocked",
@@ -1017,14 +897,14 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
         };
     }
     if (reclaimRequest) {
-        assertReclaimLiveness(coordRoot, binding, reclaimRequest.recovery);
-        assertReclaimOwnership(coordRoot, binding);
+        // The last liveness check before a destructive reset.
+        assertReclaimLiveness(coordRoot, binding, reclaimRequest.force);
         revalidateClaimResources(claim, root);
         reclaimRequest.prepared(prepareReclaim({
             worktreePath: binding.workspace_root,
             mode: reclaimRequest.mode,
             runId: binding.run_id,
-            beforeEffect: reclaimRequest.beforeEffect,
+            beforeEffect: () => assertPeerWorkspaceAuthority(coordRoot, claim),
         }));
     }
     appendWorkspaceEvent(coordRoot, claim, "cleanup_pending", {
@@ -1036,8 +916,7 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
         target_ref_oid: targetRef.out,
     });
     if (before.workspace_exists) {
-        reclaimRequest?.beforeEffect();
-        beforeRemoval?.();
+        assertPeerWorkspaceAuthority(coordRoot, claim);
         revalidateClaimResources(claim, root);
         assertContainedExisting(root, binding.workspace_root, "workspace cleanup path");
         git(repository.source_root.realpath, ["worktree", "remove", binding.workspace_root]);
@@ -1057,7 +936,6 @@ function cleanupUnderLease(coordRoot, binding, claim, intent, reclaimRequest, be
             return { ...base, status: "blocked", reason: "workspace ref changed during cleanup" };
         }
         revalidateClaimResources(claim, root);
-        reclaimRequest?.beforeRefEffect();
         const deleted = gitMaybe(repository.source_root.realpath, [
             "update-ref",
             "-d",
@@ -1810,9 +1688,13 @@ function capabilityDigestForClaim(claim) {
     void claim;
     return stableDigest(basis);
 }
+function repositoryLeasePath(coordRoot, repository) {
+    const key = stableDigest({ common: repository.common_dir.identity });
+    return join(resolve(coordRoot), ".harnery", "workspaces", PROVIDER_ID, ".leases", `repository-${key}.lock`);
+}
 function acquireRepositoryLease(coordRoot, claim) {
-    const leaseDir = join(resolve(coordRoot), ".harnery", "workspaces", PROVIDER_ID, ".leases");
-    mkdirSync(leaseDir, { recursive: true, mode: stateDirMode() });
+    const path = repositoryLeasePath(coordRoot, claim.repository);
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     // Mutual exclusion keys on the Git common directory alone. `git worktree add`,
     // `prune`, and the shared-`config` migration all write to the common directory's
     // administrative area, and once worktrees and submodules are allowed, several
@@ -1821,8 +1703,7 @@ function acquireRepositoryLease(coordRoot, claim) {
     // nested — writable roots. Including the writable root in the key would hand those
     // agents different locks and let their admin-area writes race. The writable root
     // stays in the lease metadata for diagnostics, not in the exclusion key.
-    const key = stableDigest({ common: claim.repository.common_dir.identity });
-    return acquireLease(coordRoot, join(leaseDir, `repository-${key}.lock`), claim, "repository");
+    return acquireLease(coordRoot, path, claim, "repository");
 }
 function acquireLease(coordRoot, path, claim, scope) {
     const authoritySha256 = stableDigest({

package/dist/core/workflow/workspaces/ownership.d.ts

@@ -1,11 +1,4 @@
 import type { WorkspaceClaim } from "./state.js";
-export interface WorkspaceReclaimReservation {
-    assertCurrent(): void;
-    release(): void;
-}
-/** The immutable claim is the authority; the lease reserves its destructive path. */
-export declare function reserveWorkspaceReclaim(coordRoot: string, claim: WorkspaceClaim): WorkspaceReclaimReservation;
-export declare function publishWorkspaceClaim<T>(coordRoot: string, claim: WorkspaceClaim, publish: () => T): T;
 export declare function assertClaimAuthority(claim: WorkspaceClaim, providerId: string, id: string): void;
 export declare function claimOverlapsWorkspace(claim: WorkspaceClaim, workspaceRoot: string): boolean;
 //# sourceMappingURL=ownership.d.ts.map

package/dist/core/workflow/workspaces/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/ownership.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8CjD,MAAM,WAAW,2BAA2B;IAC1C,aAAa,IAAI,IAAI,CAAC;IACtB,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,GACpB,2BAA2B,CAgC7B;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,CAAC,GACf,CAAC,CA8DH;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAwBhG;AAmCD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAU5F"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/ownership.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAwBhG;AAmCD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAU5F"}

package/dist/core/workflow/workspaces/ownership.js

@@ -1,135 +1,8 @@
-import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { readJsonRecord, stableDigest } from "../durable-record.js";
-import { acquireNoClobberLease } from "./leases.js";
+import { lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { stableDigest } from "../durable-record.js";
 import { containsPath } from "./paths.js";
 import { isWorkspaceAllocationRequest } from "./validate.js";
-const STALE_MS = 5 * 60 * 1_000;
-const RESERVATION_SCOPE = "workspace-reclaim";
-function leaseRoot(coordRoot, providerId) {
-    return join(resolve(coordRoot), ".harnery", "workspaces", providerId, ".leases");
-}
-/** Serialize only publication and reservation registration, never Git work. */
-function withPublicationGate(coordRoot, providerId, operation) {
-    const authority = stableDigest({ provider_id: providerId, scope: "workspace-publication" });
-    const gate = acquireNoClobberLease({
-        path: join(leaseRoot(coordRoot, providerId), "publication.lock"),
-        scope: "workspace-publication",
-        authoritySha256: authority,
-        staleAfterMs: STALE_MS,
-        validateStaleOwner: (owner) => owner.authority_sha256 === authority,
-    });
-    try {
-        return operation();
-    }
-    finally {
-        gate.release();
-    }
-}
-function reservationPath(coordRoot, claim) {
-    return join(leaseRoot(coordRoot, claim.provider_id), `reclaim-${claim.binding_id}.lock`);
-}
-function acquireReservation(coordRoot, claim) {
-    const authority = stableDigest(claim);
-    return acquireNoClobberLease({
-        path: reservationPath(coordRoot, claim),
-        scope: RESERVATION_SCOPE,
-        authoritySha256: authority,
-        staleAfterMs: STALE_MS,
-        metadata: { binding_id: claim.binding_id, request_sha256: claim.request_sha256 },
-        validateStaleOwner: (owner) => owner.authority_sha256 === authority &&
-            owner.metadata?.binding_id === claim.binding_id &&
-            owner.metadata?.request_sha256 === claim.request_sha256,
-    });
-}
-/** The immutable claim is the authority; the lease reserves its destructive path. */
-export function reserveWorkspaceReclaim(coordRoot, claim) {
-    assertClaimAuthority(claim, claim.provider_id, claim.binding_id);
-    const lease = withPublicationGate(coordRoot, claim.provider_id, () => acquireReservation(coordRoot, claim));
-    return {
-        assertCurrent() {
-            const path = reservationPath(coordRoot, claim);
-            const current = join(path, "current");
-            const pin = join(path, lease.owner.owner_file);
-            const a = lstatSync(current, { bigint: true });
-            const b = lstatSync(pin, { bigint: true });
-            if (!a.isFile() ||
-                !b.isFile() ||
-                a.dev !== b.dev ||
-                a.ino !== b.ino ||
-                readFileSync(current, "utf8") !== readFileSync(pin, "utf8") ||
-                stableDigest(readJsonRecord(current, "reclaim reservation")) !== stableDigest(lease.owner)) {
-                throw new Error("workspace reclaim reservation owner changed");
-            }
-            const persisted = readJsonRecord(join(dirname(dirname(path)), claim.binding_id, "claim.json"), "reserved workspace claim");
-            if (stableDigest(persisted) !== stableDigest(claim)) {
-                throw new Error("workspace reclaim reservation claim changed");
-            }
-        },
-        release: () => lease.release(),
-    };
-}
-export function publishWorkspaceClaim(coordRoot, claim, publish) {
-    assertClaimAuthority(claim, claim.provider_id, claim.binding_id);
-    return withPublicationGate(coordRoot, claim.provider_id, () => {
-        for (const entry of readdirSync(leaseRoot(coordRoot, claim.provider_id), {
-            withFileTypes: true,
-        })) {
-            if (!entry.name.startsWith("reclaim-") || !entry.name.endsWith(".lock"))
-                continue;
-            if (!entry.isDirectory())
-                throw new Error("workspace reclaim reservation is not a directory");
-            const path = join(leaseRoot(coordRoot, claim.provider_id), entry.name);
-            const current = join(path, "current");
-            try {
-                lstatSync(current);
-            }
-            catch (error) {
-                if (error.code === "ENOENT")
-                    continue;
-                throw error;
-            }
-            const id = entry.name.slice("reclaim-".length, -".lock".length);
-            const reserved = readJsonRecord(join(dirname(leaseRoot(coordRoot, claim.provider_id)), id, "claim.json"), "reserved workspace claim");
-            assertClaimAuthority(reserved, claim.provider_id, id);
-            // Unknown reservation authority is never interpreted as an unrelated owner.
-            const owner = readJsonRecord(current, "reclaim reservation");
-            if (owner.schema_version !== 1 ||
-                typeof owner.owner_id !== "string" ||
-                !/^[a-f0-9-]{36}$/.test(owner.owner_id) ||
-                owner.owner_file !== `owner-${owner.owner_id}.json` ||
-                !Number.isSafeInteger(owner.pid) ||
-                owner.pid <= 0 ||
-                typeof owner.host !== "string" ||
-                owner.host.length === 0 ||
-                !Number.isFinite(Date.parse(owner.created_at)) ||
-                !Number.isFinite(Date.parse(owner.expires_at)) ||
-                Date.parse(owner.expires_at) < Date.parse(owner.created_at) ||
-                owner.scope !== RESERVATION_SCOPE ||
-                owner.authority_sha256 !== stableDigest(reserved) ||
-                owner.metadata?.binding_id !== id ||
-                owner.metadata?.request_sha256 !== reserved.request_sha256) {
-                throw new Error("workspace reclaim reservation authority is unproven");
-            }
-            const a = lstatSync(current, { bigint: true });
-            const pin = join(path, owner.owner_file);
-            const b = lstatSync(pin, { bigint: true });
-            if (!a.isFile() ||
-                !b.isFile() ||
-                a.dev !== b.dev ||
-                a.ino !== b.ino ||
-                readFileSync(current, "utf8") !== readFileSync(pin, "utf8"))
-                throw new Error("workspace reclaim reservation owner is unproven");
-            if (!claimOverlapsWorkspace(claim, reserved.workspace_root))
-                continue;
-            // This succeeds only for an expired, provably dead, exact prior owner.
-            // It retires the reservation, never the immutable claim or resource.
-            const recovered = acquireReservation(coordRoot, reserved);
-            recovered.release();
-        }
-        return publish();
-    });
-}
 export function assertClaimAuthority(claim, providerId, id) {
     if (claim?.schema_version !== 1 ||
         !/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(providerId) ||

package/dist/core/workflow/workspaces/reclaim.d.ts

@@ -14,11 +14,10 @@
  * always has. So reclaim adds no second removal path that could diverge from the
  * audited one, and a force-delete of live work exists nowhere in the codebase.
  */
-import type { WorkflowRecoveryAuthorization } from "../recovery-audit.js";
 import type { WorkflowLiveness } from "./recovery.js";
 import type { WorkspaceCleanupAttempt, WorkspaceCleanupReceipt } from "./types.js";
 export type ReclaimMode = "salvage" | "discard";
-export type WorkflowReclaimRefusalCode = "workflow_reclaim_run_live" | "workflow_reclaim_liveness_unknown" | "workflow_reclaim_recovery_mismatch" | "workflow_reclaim_ownership_unproven" | "workflow_reclaim_lease_held";
+export type WorkflowReclaimRefusalCode = "workflow_reclaim_run_live" | "workflow_reclaim_liveness_unknown" | "workflow_reclaim_ownership_unproven" | "workflow_reclaim_lease_held";
 export declare class WorkflowReclaimError extends Error {
     readonly code: WorkflowReclaimRefusalCode;
     constructor(code: WorkflowReclaimRefusalCode, message: string);
@@ -26,9 +25,8 @@ export declare class WorkflowReclaimError extends Error {
 export interface WorkspaceReclaimOptions {
     mode: ReclaimMode;
     yes?: boolean;
-    unknownLiveness?: WorkflowRecoveryAuthorization & {
-        evidenceSha256: string;
-    };
+    /** Admit missing or corrupt liveness evidence; active evidence still refuses. */
+    force?: boolean;
 }
 export interface ReclaimLeaseHolder {
     scope: "binding" | "repository" | "resume";
@@ -42,7 +40,6 @@ export interface WorkspaceReclaimPreview {
     run_id: string;
     mode: ReclaimMode;
     liveness: WorkflowLiveness;
-    evidence_sha256: string;
     ownership: "ok" | "unproven";
     ownership_detail?: string;
     dirty_paths: string[] | null;
@@ -72,7 +69,7 @@ export interface PrepareReclaimInput {
     worktreePath: string;
     mode: ReclaimMode;
     runId: string;
-    /** Revalidate the held reservation and peer authority immediately before effects. */
+    /** Recheck peer authority once, immediately before the first destructive step. */
     beforeEffect?: () => void;
 }
 /**

package/dist/core/workflow/workspaces/reclaim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,MAAM,0BAA0B,GAClC,2BAA2B,GAC3B,mCAAmC,GACnC,oCAAoC,GACpC,qCAAqC,GACrC,6BAA6B,CAAC;AAElC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,6BAA6B,GAAG;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,GAAG,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,CAAC,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC,GAAG;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;CAC5D,CAAC,CAAC;AAEP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAwD7E;AAYD;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,MAAM,0BAA0B,GAClC,2BAA2B,GAC3B,mCAAmC,GACnC,qCAAqC,GACrC,6BAA6B,CAAC;AAElC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EACzC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,IAAI,GAAG,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,CAAC,IAAI,CAAC,uBAAuB,EAAE,QAAQ,CAAC,GAAG;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;CAC5D,CAAC,CAAC;AAEP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAoD7E;AAYD;qEACqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}