`process --reinvestigate` and direct mode take files that another run is still investigating

What happened

A process run started with --reinvestigate or a file list (--diff, --files, --files-from) claims files that another live run has locked. Both runs investigate the file, and the run that writes last overwrites the other run's findings and analysisHistory entry for that file.

The claim loop skips the lock check in those modes:

https://github.com/vercel-labs/deepsec/blob/4fa67220aff67ac93dfc840206d3d32bfa4411ec/packages/processor/src/index.ts#L542-L551

inForceMode is there so these modes can re-claim analyzed files. It also lets them take a processing file whose lock isReclaimableLock rejects, which is a file that another run is still working on.

Reproduction

The scenario is two overlapping runs on one project:

pnpm deepsec process --project-id your_project_id                  # terminal 1
pnpm deepsec process --project-id your_project_id --reinvestigate  # terminal 2, while run 1 is still going

I didn't run two paid investigations to confirm it. I reproduced it with a processor test that uses a stub agent. The test seeds a file that is locked by a run whose metadata says running and whose PID is alive, then calls process() once with reinvestigate: true and once with filePaths. On main the stub agent investigates the locked file in both modes. I'll open a pull request with that test and a one-condition fix, and link it here.

Expected vs actual

Expected: run 2 skips files that run 1 holds, as it does without --reinvestigate.

Actual: run 2 sets lockedByRunId to its own run ID on those files and investigates them.

Environment

• deepsec version (pnpm deepsec --version): 2.3.10 (main at 4fa6722)
• Node version (node --version): 24.21.0
• OS: macOS 26.5.1
• Agent backend (claude-agent-sdk / codex): none, stub agent in the processor tests
• Model: none

Logs

None. The stub-agent test asserts on the batches the agent receives and on the stored file records.