harnery 0.45.1 → 0.45.2

package/dist/core/workflow/workspaces/reclaim.js

@@ -51,7 +51,6 @@ export function prepareReclaim(input) {
         // cannot see. Running clean first would leave staged deletions behind.
         input.beforeEffect?.();
         git(input.worktreePath, ["reset", "--hard"]);
-        input.beforeEffect?.();
         git(input.worktreePath, ["clean", "-fd"]);
         return { action: "discarded", detail: "uncommitted changes were discarded on request" };
     }
@@ -71,13 +70,10 @@ export function prepareReclaim(input) {
     const before = git(input.worktreePath, ["rev-parse", "HEAD"]).trim();
     input.beforeEffect?.();
     git(input.worktreePath, ["add", "-A"]);
-    input.beforeEffect?.();
     git(input.worktreePath, ["commit", "--no-verify", "-m", salvageMessage(input.runId)]);
     const commit = git(input.worktreePath, ["rev-parse", "HEAD"]).trim();
     const branch = salvageBranch(input.runId);
-    input.beforeEffect?.();
     git(input.worktreePath, ["branch", "--force", branch, commit]);
-    input.beforeEffect?.();
     git(input.worktreePath, ["reset", "--hard", before]);
     return {
         action: "salvaged",

package/dist/core/workflow/workspaces/recovery.d.ts

@@ -1,5 +1,5 @@
 export type WorkflowLiveness = "active" | "inactive" | "unknown";
-/** Corruption must not hide a readable active marker from an audited override. */
+/** Corruption must not hide a readable active marker from a forced reclaim. */
 export declare function hasActiveWorkflowEvidence(coordRoot: string, runId: string): boolean;
 export declare function readWorkflowLiveness(coordRoot: string, runId: string): WorkflowLiveness;
 //# sourceMappingURL=recovery.d.ts.map

package/dist/core/workflow/workspaces/recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/recovery.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEjE,kFAAkF;AAClF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBnF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6DvF"}
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/recovery.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAEjE,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBnF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6DvF"}

package/dist/core/workflow/workspaces/recovery.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { readWorkflowProof } from "../proof.js";
-/** Corruption must not hide a readable active marker from an audited override. */
+/** Corruption must not hide a readable active marker from a forced reclaim. */
 export function hasActiveWorkflowEvidence(coordRoot, runId) {
     const path = join(resolve(coordRoot), ".harnery", "workflows", runId, "transcript.jsonl");
     if (!existsSync(path))

package/dist/core/workflow/workspaces/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/state.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,CAAC,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,0BAA0B,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,UAAU,EAAE;QACV,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACjD,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,CAAC,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAIR;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAIR;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,0BAA0B,GAAG,SAAS,CAKxC;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAErF;AAgBD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,EAAE,CAY3F;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,SAAS,CAG5B;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAK3F;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,gBAAgB,GAAG,SAAS,CAG9B;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,sBAAsB,CAwCxB;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,sBAAsB,EAAE,CA0C1B;AAOD,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,4BAA4B,GAC5B,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,iBAAiB,GAAG,eAAe,CAAC,GAChF,uBAAuB,CA4BzB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,iBAAiB,GAAG,eAAe,CAAC,GAChF,uBAAuB,CAiBzB;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,EAAE,CAK3B;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAK/F;AA8DD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,kBAAkB,GACxB,MAAM,CAUR;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,CAAC,GAAG,SAAS,CAGf;AAMD,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../../src/core/workflow/workspaces/state.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,CAAC,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,0BAA0B,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,UAAU,EAAE;QACV,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACjD,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,CAAC,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAIR;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAIR;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,0BAA0B,GAAG,SAAS,CAKxC;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAYrF;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,EAAE,CAY3F;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,SAAS,CAG5B;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAK3F;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,gBAAgB,GAAG,SAAS,CAG9B;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,sBAAsB,CAwCxB;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,sBAAsB,EAAE,CA0C1B;AAOD,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,4BAA4B,GAC5B,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,iBAAiB,GAAG,eAAe,CAAC,GAChF,uBAAuB,CA4BzB;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,iBAAiB,GAAG,eAAe,CAAC,GAChF,uBAAuB,CAiBzB;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,uBAAuB,EAAE,CAK3B;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAK/F;AA8DD,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,kBAAkB,GACxB,MAAM,CAUR;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,CAAC,GAAG,SAAS,CAGf;AAMD,OAAO,EACL,aAAa,EACb,UAAU,EACV,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/core/workflow/workspaces/state.js

@@ -2,7 +2,7 @@ import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readd
 import { dirname, join, resolve } from "node:path";
 import { stateDirMode, stateFileMode } from "../../storage/modes.js";
 import { canonicalJson, fsyncParentDirectory, readJsonRecord, stableDigest, writeImmutableJson, } from "../durable-record.js";
-import { assertClaimAuthority, publishWorkspaceClaim } from "./ownership.js";
+import { assertClaimAuthority } from "./ownership.js";
 export { appendWorkflowTranscriptEvent } from "../transcript.js";
 const JSON_LIMIT = 512 * 1024;
 const WORKSPACE_EVENT_BYTES = 32 * 1024;
@@ -40,9 +40,6 @@ export function readWorkspaceRequest(coordRoot, runId) {
         : undefined;
 }
 export function writeWorkspaceClaim(coordRoot, claim) {
-    return publishWorkspaceClaim(coordRoot, claim, () => writeClaim(coordRoot, claim));
-}
-function writeClaim(coordRoot, claim) {
     const path = workspaceClaimPath(coordRoot, claim.provider_id, claim.binding_id);
     try {
         return writeImmutableJson(path, claim);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harnery",
-  "version": "0.45.1",
+  "version": "0.45.2",
   "description": "Multi-agent coordination for AI coding agents - Claude Code, Cursor, and Codex.",
   "license": "MIT",
   "author": "Ryan Kelly",

package/src/commands/workflow.ts

@@ -73,15 +73,7 @@ interface WorkflowConfirmedMutationOpts {
 
 interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
   discard?: boolean;
-  unknownLiveness?: string;
-  actor?: string;
-  reason?: string;
-}
-
-interface WorkflowUnlockOpts extends WorkflowConfirmedMutationOpts {
-  lockSha256?: string;
-  actor?: string;
-  reason?: string;
+  force?: boolean;
 }
 
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
@@ -632,11 +624,9 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
     .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
     .option("--discard", "Throw the uncommitted work away instead of salvaging it")
     .option(
-      "--unknown-liveness <sha256>",
-      "Recover unknown evidence pinned by the preview digest; active evidence still refuses",
+      "--force",
+      "With --yes, admit missing or corrupt liveness evidence (active evidence still refuses) and record it",
     )
-    .option("--actor <id>", "Actor responsible for an audited recovery")
-    .option("--reason <text>", "Reason for an audited recovery")
     .option("--json", "Emit the reclaim preview or confirmed result as JSON")
     .action(async (runId: string, opts: WorkflowReclaimOpts) => {
       const coordRoot = resolveCoordRoot();
@@ -663,13 +653,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
         const result = await provider.reclaim(binding, {
           mode: opts.discard ? "discard" : "salvage",
           yes: opts.yes,
-          unknownLiveness: opts.unknownLiveness
-            ? {
-                evidenceSha256: opts.unknownLiveness,
-                actor: opts.actor!,
-                reason: opts.reason!,
-              }
-            : undefined,
+          force: opts.force,
         });
         if (opts.json) {
           emit.config({ format: "json" });
@@ -684,11 +668,13 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
           emit.text(
             `reclaim preview: ${result.run_id}\n` +
               `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
-              `evidence sha256: ${result.evidence_sha256}\n` +
               `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
               `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
               (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
-              `Pass --yes to confirm ${result.mode} and release after all checks pass.\n`,
+              `Pass --yes to confirm ${result.mode} and release after all checks pass.\n` +
+              (result.liveness === "unknown"
+                ? "Liveness is unknown; add --force with --yes only if the run is known to be stopped.\n"
+                : ""),
           );
           return;
         }
@@ -708,42 +694,6 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
-  workflow
-    .command("unlock <run-id>")
-    .description(
-      "Preview or explicitly retire one exact resume lock whose local owner is proven dead.",
-    )
-    .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
-    .option("--actor <id>", "Actor responsible for the recovery")
-    .option("--reason <text>", "Reason for the recovery")
-    .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
-    .option("--json", "Emit the recovery preview or result as JSON")
-    .action(async (runId: string, opts: WorkflowUnlockOpts) => {
-      try {
-        const coordRoot = resolveCoordRoot();
-        if (!coordRoot) throw new Error("no .harnery/ coordination root found");
-        const { recoverWorkflowResumeLease } = await import("../core/workflow/index.ts");
-        const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
-        if (opts.json) {
-          emit.config({ format: "json" });
-          emit.data(result);
-          return;
-        }
-        emit.text(
-          `resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
-            (result.action === "preview"
-              ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
-              : `recovery: ${result.recovery_id}\n`),
-        );
-      } catch (error) {
-        emit.error({
-          code: "workflow_resume_unlock_failed",
-          message: error instanceof Error ? error.message : String(error),
-        });
-        process.exit(1);
-      }
-    });
-
   const approvals = program
     .command("approval")
     .description("Inspect and resolve durable run-policy approvals.");

package/src/core/agents/coord-client.ts

@@ -265,27 +265,7 @@ export function parsePidmapRowStartToken(row: string): string | undefined {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid: number): string | null {
-  if (!Number.isInteger(pid) || pid <= 0) return null;
   const forced = process.env.HARNERY_PID_PROBE;
-  if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
-    try {
-      const out = spawnSync(
-        "powershell.exe",
-        [
-          "-NoLogo",
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
-        ],
-        { encoding: "utf8", timeout: 10_000, windowsHide: true },
-      );
-      const token = String(out.stdout ?? "").trim();
-      return out.status === 0 && /^w\d+$/.test(token) ? token : null;
-    } catch {
-      return null;
-    }
-  }
   const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
   // One machine, one probe. Falling back to the other on a read failure would
   // answer in the wrong dialect and read as a recycled pid.

package/src/core/agents/state/pidmap.ts

@@ -24,7 +24,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import { checkPidToken, processStartToken } from "./proc-start.ts";
+import { processStartToken, verifyProcessGeneration } from "./proc-start.ts";
 
 /**
  * Row count that triggers a dead-row sweep on the next write.
@@ -59,7 +59,7 @@ export function parsePidmapRow(row: string): {
  */
 function rowStillNamesItsProcess(pid: number, startToken: string | undefined): boolean {
   if (!pidIsAlive(pid)) return false;
-  return checkPidToken(pid, startToken) !== "mismatch";
+  return verifyProcessGeneration(pid, startToken) !== "different";
 }
 
 function atomicWrite(path: string, content: string): void {

package/src/core/agents/state/proc-start.ts

@@ -34,10 +34,9 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.ts";
-import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.ts";
 
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps" | "windows";
+export type StartTokenProbe = "procfs" | "ps";
 
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
@@ -61,7 +60,6 @@ let cachedBootId: string | null | undefined;
 export function startTokenProbe(): StartTokenProbe {
   const override = coordEnv("PID_PROBE");
   if (override === "procfs" || override === "ps") return override;
-  if (process.platform === "win32") return "windows";
   if (cachedProbe === undefined) {
     cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
   }
@@ -104,7 +102,7 @@ export function resetStartTokenCaches(): void {
  * than by splitting the whole line, because comm is the executable name in
  * parentheses and may itself contain spaces and parens. The boot segment is
  * dropped rather than faked when the kernel will not name its boot, which
- * yields the pre-boot-id shape that `tokensAgree` still accepts.
+ * yields the pre-boot-id shape that `verifyProcessGeneration` compares by ticks.
  */
 export function procfsStartToken(pid: number): string | null {
   let stat: string;
@@ -159,19 +157,26 @@ function defaultPsRun(pid: number): { status: number | null; stdout: string } {
  */
 export function processStartToken(pid: number): string | null {
   if (!Number.isFinite(pid) || pid <= 0) return null;
-  const probe = startTokenProbe();
-  return probe === "windows"
-    ? windowsProcessStartToken(pid)
-    : probe === "procfs"
-      ? procfsStartToken(pid)
-      : psStartToken(pid);
+  return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
 }
 
 export type ProcessGenerationVerdict = "same" | "different" | "unknown";
 
 type ReadProcessStartToken = (pid: number) => string | null;
 
-/** A missing or unreadable token never establishes process identity. */
+/**
+ * Does `pid` still name the run that wrote `recordedToken`?
+ *
+ * - `"same"`: both tokens present and equal.
+ * - `"different"`: the pid was recycled. A liveness check cannot see this,
+ *   because a recycled pid is alive.
+ * - `"unknown"`: a token is missing, malformed, or unreadable. Never treat
+ *   this as proof of identity.
+ *
+ * A Linux token written without a boot segment cannot identify a run across
+ * reboots, so it is compared on its tick count: a different count proves a
+ * different run, and an equal count stays unknown.
+ */
 export function verifyProcessGeneration(
   pid: number,
   recordedToken: string | null | undefined,
@@ -184,26 +189,38 @@ export function verifyProcessGeneration(
     !recordedToken.trim()
   )
     return "unknown";
-  // A bootless Linux token cannot identify a process across machine boots.
-  if (/^l\d+$/.test(recordedToken)) return "unknown";
+  let currentToken: string | null;
   try {
-    const currentToken = readToken(pid);
-    if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
-    if (/^l\d+$/.test(currentToken)) return "unknown";
-    return currentToken === recordedToken ? "same" : "different";
+    currentToken = readToken(pid);
   } catch {
     return "unknown";
   }
+  if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
+  const bootless = (token: string) => /^l\d+$/.test(token);
+  if (
+    recordedToken[0] === "l" &&
+    currentToken[0] === "l" &&
+    (bootless(recordedToken) || bootless(currentToken))
+  )
+    return ticksOf(recordedToken) === ticksOf(currentToken) ? "unknown" : "different";
+  return currentToken === recordedToken ? "same" : "different";
+}
+
+function ticksOf(token: string): string {
+  const dot = token.indexOf(".");
+  return dot === -1 ? token.slice(1) : token.slice(dot + 1);
 }
 
 export interface ProcessGenerationSignalDependencies {
   readToken?: ReadProcessStartToken;
-  signalProcess?: typeof signalProcessWithHandle;
+  kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
 }
 
 /**
- * Observations may refuse a signal, but only the retained native process handle
- * can authorize it. No numeric-PID effect follows the preliminary token read.
+ * Recheck the process generation immediately before sending the signal.
+ *
+ * The process can still exit and its PID can be reused between the token read
+ * and the signal. Eliminating that race requires a generation-bound OS handle.
  */
 export function signalIfSameGeneration(
   pid: number,
@@ -211,58 +228,13 @@ export function signalIfSameGeneration(
   signal: NodeJS.Signals | number,
   dependencies: ProcessGenerationSignalDependencies = {},
 ): { sent: boolean; verdict: ProcessGenerationVerdict } {
+  const kill = dependencies.kill ?? process.kill;
   const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
   if (verdict !== "same") return { sent: false, verdict };
   try {
-    return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken!, signal);
+    kill(pid, signal);
+    return { sent: true, verdict };
   } catch {
-    return { sent: false, verdict: "unknown" };
+    return { sent: false, verdict };
   }
 }
-
-/**
- * Do two tokens describe the same run?
- *
- * Equality, plus one concession: a row written before tokens carried a boot
- * segment recorded the tick count alone, so it is compared on the part it
- * actually recorded. Refusing that would call every pre-upgrade row a recycled
- * pid and prune a working machine's live rows the first time the new code ran.
- * Such a row loses its reboot protection until the next write rewrites it,
- * which is a strictly better position than the one it came from.
- */
-export function tokensAgree(recorded: string, current: string): boolean {
-  if (recorded === current) return true;
-  // Only the Linux form has a boot segment to disagree about, and only when
-  // exactly one side carries one is this a shape difference rather than two
-  // genuinely different start instants.
-  if (recorded[0] !== "l" || current[0] !== "l") return false;
-  if (recorded.includes(".") === current.includes(".")) return false;
-  return ticksOf(recorded) === ticksOf(current);
-}
-
-function ticksOf(token: string): string {
-  const dot = token.indexOf(".");
-  return dot === -1 ? token.slice(1) : token.slice(dot + 1);
-}
-
-/**
- * Does `pid` still name the process a row recorded?
- *
- * Three answers, and the difference between the last two matters:
- *
- * - `"match"` — recorded token, current token, same run. The row is trustworthy.
- * - `"mismatch"` — both present and different. The pid was recycled. This is
- *   the case a liveness check cannot see, because a recycled pid is alive.
- * - `"unverified"` — no recorded token (a row written before tokens existed) or
- *   no current one (an unsupported platform). Callers treat this the way they
- *   treated every row previously: trust it if the pid is alive.
- */
-export function checkPidToken(
-  pid: number,
-  recorded: string | undefined,
-): "match" | "mismatch" | "unverified" {
-  if (!recorded) return "unverified";
-  const current = processStartToken(pid);
-  if (!current) return "unverified";
-  return tokensAgree(recorded, current) ? "match" : "mismatch";
-}

package/src/core/agents/state/service-process.ts

@@ -0,0 +1,217 @@
+/**
+ * One owner check for every singleton background service (governor, local
+ * supervisor, legacy resource observer): is the recorded process still the
+ * run that wrote the record, and how is a stop requested?
+ */
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { writePrivateJsonAtomic } from "../../storage/atomic-json.ts";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
+import {
+  type ProcessGenerationSignalDependencies,
+  type ProcessGenerationVerdict,
+  processStartToken,
+  signalIfSameGeneration,
+  verifyProcessGeneration,
+} from "./proc-start.ts";
+
+export interface ServiceProcessDependencies extends ProcessGenerationSignalDependencies {
+  /** Throws ESRCH, or returns false, when the process is gone. */
+  probePid?: (pid: number) => unknown;
+}
+
+export type ServiceLiveness = "running" | "stopped" | "unknown";
+
+export interface ServiceProcessOwner {
+  pid: number;
+  host: string;
+  start_token?: string;
+  state?: string;
+}
+
+/**
+ * A stale heartbeat does not prove that a process has exited. Another host, a
+ * probe error other than ESRCH, or an unverifiable token answers unknown. A
+ * recorded `stopped` state counts only while the generation still matches.
+ */
+export function observeServiceProcess(
+  owner: ServiceProcessOwner,
+  dependencies: ServiceProcessDependencies = {},
+): { generation: ProcessGenerationVerdict; liveness: ServiceLiveness } {
+  if (owner.host !== hostname()) return { generation: "unknown", liveness: "unknown" };
+  try {
+    if ((dependencies.probePid ?? ((pid) => process.kill(pid, 0)))(owner.pid) === false)
+      return { generation: "unknown", liveness: "stopped" };
+  } catch (error) {
+    return {
+      generation: "unknown",
+      liveness: (error as NodeJS.ErrnoException).code === "ESRCH" ? "stopped" : "unknown",
+    };
+  }
+  const generation = verifyProcessGeneration(owner.pid, owner.start_token, dependencies.readToken);
+  return {
+    generation,
+    liveness:
+      generation === "same"
+        ? owner.state === "stopped"
+          ? "stopped"
+          : "running"
+        : generation === "different"
+          ? "stopped"
+          : "unknown",
+  };
+}
+
+/** Refuse a start while another owner runs or cannot be identified. */
+export function serviceStartRefusal(
+  label: string,
+  stopCommand: string,
+  pid: number | undefined,
+  liveness: ServiceLiveness,
+): Error {
+  return new Error(
+    liveness === "running"
+      ? `${label} is already running under pid ${pid}`
+      : `${label} process generation is unknown${pid ? ` for pid ${pid}` : ""}; run \`${stopCommand}\` to write a durable stop request before starting it again`,
+  );
+}
+
+export interface ServiceLease {
+  pid: number;
+  start_token?: string;
+  host: string;
+  nonce: string;
+  created_at?: string;
+}
+
+export function readServiceLease(path: string): ServiceLease | undefined {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8")) as Partial<ServiceLease>;
+    if (
+      !Number.isSafeInteger(value.pid) ||
+      (value.pid ?? 0) <= 0 ||
+      typeof value.host !== "string" ||
+      !value.host ||
+      typeof value.nonce !== "string" ||
+      !value.nonce
+    )
+      return undefined;
+    return {
+      ...value,
+      start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+    } as ServiceLease;
+  } catch {
+    return undefined;
+  }
+}
+
+/** An absent lease is stopped; an unreadable one cannot be identified. */
+export function serviceLeaseOwner(path: string): {
+  lease?: ServiceLease;
+  liveness: ServiceLiveness;
+} {
+  if (!existsSync(path)) return { liveness: "stopped" };
+  const lease = readServiceLease(path);
+  return { lease, liveness: lease ? observeServiceProcess(lease).liveness : "unknown" };
+}
+
+/**
+ * Take the singleton lease with an exclusive create. A lease whose owner is
+ * proven stopped is replaced; any other owner refuses the start.
+ */
+export function acquireServiceLease(
+  path: string,
+  refuse: (pid: number | undefined, liveness: ServiceLiveness) => Error,
+  fields: Record<string, unknown> = {},
+): { nonce: string; release: () => void } {
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const startToken = processStartToken(process.pid);
+    const lease = {
+      ...fields,
+      pid: process.pid,
+      ...(startToken ? { start_token: startToken } : {}),
+      host: hostname(),
+      nonce: randomUUID(),
+      created_at: new Date().toISOString(),
+    };
+    try {
+      const fd = openSync(path, "wx", stateFileMode());
+      try {
+        writeFileSync(fd, `${JSON.stringify(lease)}\n`, "utf8");
+      } finally {
+        closeSync(fd);
+      }
+      return {
+        nonce: lease.nonce,
+        release: () => {
+          if (readServiceLease(path)?.nonce !== lease.nonce) return;
+          try {
+            unlinkSync(path);
+          } catch {
+            // A missing lease is already released.
+          }
+        },
+      };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const owner = serviceLeaseOwner(path);
+      if (owner.liveness !== "stopped") throw refuse(owner.lease?.pid, owner.liveness);
+      try {
+        unlinkSync(path);
+      } catch {
+        // A concurrent starter may have replaced or removed the stale lease.
+      }
+    }
+  }
+  throw new Error(`could not acquire the singleton lease at ${path}`);
+}
+
+export interface ServiceStopFields {
+  signal_sent: boolean;
+  signal_verdict: ProcessGenerationVerdict;
+}
+
+/**
+ * Write the durable stop request, then SIGTERM the owner `status` observed as
+ * running on this host, after a fresh generation check. The request stays for
+ * the daemon either way; `read` reports the state afterward.
+ */
+export function requestServiceStop<
+  S extends {
+    liveness: ServiceLiveness;
+    generation: ProcessGenerationVerdict;
+    record?: ServiceProcessOwner;
+  },
+>(
+  status: S,
+  read: () => S,
+  stopPath: string,
+  dependencies: ServiceProcessDependencies = {},
+  options: { signal?: boolean } = {},
+): S & ServiceStopFields {
+  writePrivateJsonAtomic(stopPath, {
+    requested_at: new Date().toISOString(),
+    requested_by_pid: process.pid,
+  });
+  const signal =
+    options.signal !== false && status.liveness === "running" && status.record?.host === hostname()
+      ? signalIfSameGeneration(
+          status.record.pid,
+          status.record.start_token,
+          "SIGTERM",
+          dependencies,
+        )
+      : { sent: false, verdict: status.generation };
+  return { ...read(), signal_sent: signal.sent, signal_verdict: signal.verdict };
+}