@opengsd/gsd-pi 1.2.0-dev.b1abb545 → 1.2.0-dev.e8563f58

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -15,30 +15,20 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import type { CompleteSliceParams } from "../types.js";
-import { isClosedStatus } from "../status-guards.js";
 import {
-  transaction,
-  insertMilestone,
-  insertSlice,
-  getSlice,
-  getSliceTasks,
-  getMilestone,
-  updateSliceStatus,
+  completeSliceCascade,
   setSliceSummaryMd,
   saveGateResult,
   getPendingGatesForTurn,
-  getMilestoneSlices,
-  updateMilestoneStatus,
 } from "../gsd-db.js";
 import { getGatesForTurn } from "../gate-registry.js";
 import { gsdProjectionRoot, clearPathCache, resolveMilestoneFile } from "../paths.js";
 import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
 import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
-import { getDeclaredUatType, shouldEscalateArtifactUatToBrowser } from "../uat-policy.js";
+import { classifyUatContent, escalatesArtifactUatToBrowser } from "../uat-policy.js";
 import { invalidateStateCache } from "../state.js";
-import { renderRoadmapFromDb } from "../markdown-renderer.js";
-import { parseRoadmap } from "../parsers-legacy.js";
+import { renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "../markdown-renderer.js";
 import { isStaleWrite } from "../auto/turn-epoch.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
@@ -100,9 +90,11 @@ function hasCompleteSliceArtifactContract(basePath: string, milestoneId: string,
     join(gsdProjectionRoot(basePath), "milestones", milestoneId, `${milestoneId}-ROADMAP.md`);
   if (!existsSync(roadmapPath)) return false;
 
+  // Projection-completeness check (ADR-017): the DB has already recorded the
+  // duplicate completion; this only verifies the rendered markdown artifacts
+  // exist and reflect it, deciding whether re-rendering is needed.
   try {
-    const roadmap = parseRoadmap(readFileSync(roadmapPath, "utf-8"));
-    return roadmap.slices.some((slice) => slice.id === sliceId && slice.done);
+    return roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sliceId);
   } catch {
     return false;
   }
@@ -364,67 +356,49 @@ export async function handleCompleteSlice(
   // `npx playwright test` via gsd_uat_exec, and live-runtime/mixed/
   // browser-executable receive browser tools (UAT_MODE_POLICIES).
   const uatContent = params.uatContent || "";
-  const declaredUatMode = getDeclaredUatType(uatContent);
-  if (shouldEscalateArtifactUatToBrowser(uatContent)) {
+  const uatPolicy = classifyUatContent(uatContent);
+  if (escalatesArtifactUatToBrowser(uatPolicy)) {
+    // Distinguish an explicit artifact-driven declaration from a missing or
+    // unparseable one that merely *defaulted* to artifact-driven — telling an
+    // agent it "declared artifact-driven" when its declaration simply failed
+    // to parse sends it into a rewrite loop with the same unparseable format.
+    const staticOnlyClause = `which only runs static/file checks and would defer the browser work to a human`;
+    const modeClause = uatPolicy.modeDeclared
+      ? `declares "UAT mode: artifact-driven", ${staticOnlyClause}`
+      : `has no parseable UAT mode declaration in its "## UAT Type" section (the declaration must be a bullet exactly like "- UAT mode: browser-executable"), so it defaults to "artifact-driven", ${staticOnlyClause}`;
     return {
-      error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but declares "UAT mode: artifact-driven", which only runs static/file checks and would defer the browser work to a human. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
+      error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but ${modeClause}. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
     };
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // ── Atomic completion cascade (guards + writes in one transaction) ───────
   const completedAt = new Date().toISOString();
   let guardError: string | null = null;
   let existingSummaryMd = "";
   let duplicateComplete = false;
 
-  transaction(() => {
-    // State machine preconditions (inside txn for atomicity).
-    // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
-    // Only block if they exist and are closed.
-    const milestone = getMilestone(params.milestoneId);
-    if (milestone && isClosedStatus(milestone.status)) {
-      guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-      return;
-    }
-
-    const slice = getSlice(params.milestoneId, params.sliceId);
-    existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
-    if (slice && isClosedStatus(slice.status)) {
-      duplicateComplete = true;
-      return;
-    }
-
-    // Verify all tasks are complete
-    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-    if (tasks.length === 0) {
-      guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
-      return;
-    }
-
-    const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
-    if (incompleteTasks.length > 0) {
-      const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-      guardError = `incomplete tasks: ${incompleteIds}`;
-      return;
-    }
-
-    // All guards passed — perform writes. Preserve existing planning metadata:
-    // completion should not overwrite title/risk/depends/demo/sequence.
-    insertMilestone({ id: params.milestoneId, title: params.milestoneId });
-    if (!slice) {
-      insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceTitle || params.sliceId });
-    }
-    updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
-
-    const updatedSlices = getMilestoneSlices(params.milestoneId);
-    if (
-      milestone?.status === "planned" &&
-      updatedSlices.length > 0 &&
-      updatedSlices.every((s) => isClosedStatus(s.status))
-    ) {
-      updateMilestoneStatus(params.milestoneId, "active");
-    }
+  const outcome = completeSliceCascade(params.milestoneId, params.sliceId, {
+    sliceTitle: params.sliceTitle,
+    completedAt,
   });
+  if (outcome.ok) {
+    existingSummaryMd = outcome.existingSummaryMd;
+    duplicateComplete = outcome.duplicate;
+  } else {
+    switch (outcome.reason) {
+      case "milestone-closed":
+        guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})`;
+        break;
+      case "no-tasks":
+        guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+        break;
+      case "incomplete-tasks": {
+        const incompleteIds = outcome.incomplete.map((t) => `${t.id} (status: ${t.status})`).join(", ");
+        guardError = `incomplete tasks: ${incompleteIds}`;
+        break;
+      }
+    }
+  }
 
   if (duplicateComplete) {
     const staleSummaryPath = sliceSummaryPath(
@@ -505,8 +479,9 @@ export async function handleCompleteSlice(
 
     const roadmap = await renderRoadmapFromDb(artifactBasePath, params.milestoneId);
     clearParseCache();
-    const roadmapSlice = parseRoadmap(roadmap.content).slices.find((slice) => slice.id === params.sliceId);
-    if (!roadmapSlice?.done) {
+    // Render verification (ADR-017): confirms the just-written projection
+    // reflects the DB completion; the DB row is already committed.
+    if (!roadmapRenderMarksSliceDone(roadmap.content, params.sliceId)) {
       throw new Error(`roadmap render did not mark ${params.milestoneId}/${params.sliceId} complete`);
     }
   } catch (renderErr) {

package/src/resources/extensions/gsd/tools/exec-tool.ts

@@ -11,6 +11,7 @@ import {
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
+import { projectRootFromWorktreePath } from "../worktree-root.js";
 import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
 export interface ExecToolParams {
@@ -201,13 +202,9 @@ function normalizeScanPath(value: string): string {
 
 function parseWorktreeBase(baseDir: string): { originalRoot: string; worktreeRoot: string } | null {
   const normalizedBase = normalizeScanPath(baseDir);
-  const marker = "/.gsd/worktrees/";
-  const markerIndex = normalizedBase.indexOf(marker);
-  if (markerIndex <= 0) return null;
-  return {
-    originalRoot: normalizedBase.slice(0, markerIndex),
-    worktreeRoot: normalizedBase,
-  };
+  const originalRoot = projectRootFromWorktreePath(normalizedBase);
+  if (!originalRoot) return null;
+  return { originalRoot, worktreeRoot: normalizedBase };
 }
 
 function pathInside(parent: string, target: string): boolean {
@@ -297,7 +294,7 @@ function scriptReferencesOriginalRootFromWorktree(script: string, baseDir: strin
   const normalizedScript = script.replace(/\\/g, "/");
   return comparablePathVariants(parsed.originalRoot).some((originalRoot) => {
     const originalRootPattern = new RegExp(
-      `${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`,
+      `${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd(?:-worktrees|/worktrees)(?:/|$)))`,
     );
     return originalRootPattern.test(normalizedScript);
   });
@@ -427,6 +424,7 @@ function formatResult(result: ExecSandboxResult): ToolExecutionResult {
       exit_code: result.exit_code,
       signal: result.signal,
       timed_out: result.timed_out,
+      force_resolved: result.force_resolved,
       duration_ms: result.duration_ms,
       stdout_bytes: result.stdout_bytes,
       stderr_bytes: result.stderr_bytes,
@@ -441,6 +439,9 @@ function formatResult(result: ExecSandboxResult): ToolExecutionResult {
 }
 
 function formatExit(result: ExecSandboxResult): string {
+  // force_resolved means a non-closing (D-state) child was force-resolved past its
+  // hard deadline rather than observed exiting; distinguish it from a clean timeout.
+  if (result.force_resolved) return "timeout(force-killed)";
   if (result.timed_out) return "timeout";
   if (result.signal) return `signal:${result.signal}`;
   if (result.exit_code === null) return "null";

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -26,8 +26,9 @@ import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
 import { validatePathOnlyPlanningFields, validatePlanningPathScope } from "../planning-path-scope.js";
-import { checkFilePathConsistency, checkTaskOrdering } from "../pre-execution-checks.js";
+import { runTaskPathChecks } from "../pre-execution-checks.js";
 import type { TaskRow } from "../db-task-slice-rows.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { buildTaskFileName, gsdProjectionRoot } from "../paths.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { createRepositoryRegistryFromPreferences, defaultRepositoryTargets, type RepositoryRegistry } from "../repository-registry.js";
@@ -268,11 +269,16 @@ function validateTaskPathsBeforePersist(
   const additionalRoots = allowedRoots
     .map((root) => resolve(root))
     .filter((root) => root !== baseRoot);
-  const context = additionalRoots.length > 0 ? { additionalRoots } : undefined;
-  const checks = [
-    ...checkFilePathConsistency(taskRows, basePath, context),
-    ...checkTaskOrdering(taskRows, basePath, context),
-  ];
+  const resolvedCanonicalRoot = resolve(resolveWorktreeProjectRoot(basePath));
+  const canonicalProjectRoot = resolvedCanonicalRoot !== baseRoot ? resolvedCanonicalRoot : undefined;
+  const hasContext = additionalRoots.length > 0 || canonicalProjectRoot !== undefined;
+  const context = hasContext
+    ? {
+        ...(additionalRoots.length > 0 ? { additionalRoots } : {}),
+        ...(canonicalProjectRoot !== undefined ? { canonicalProjectRoot } : {}),
+      }
+    : undefined;
+  const checks = runTaskPathChecks(taskRows, basePath, context);
   const blocking = checks.filter((check) => !check.passed && check.blocking);
 
   if (blocking.length === 0) return null;

package/src/resources/extensions/gsd/tools/reopen-milestone.ts

@@ -10,16 +10,11 @@
  */
 
 import {
-  getMilestone,
   getMilestoneSlices,
   getSliceTasks,
-  reopenMilestoneStatus,
-  updateSliceStatus,
-  updateTaskStatus,
-  transaction,
+  reopenMilestoneCascade,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -53,40 +48,18 @@ export async function handleReopenMilestone(
     return { error: "milestoneId is required and must be a non-empty string" };
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-  let guardError: string | null = null;
-  let slicesResetCount = 0;
-  let tasksResetCount = 0;
-
-  transaction(() => {
-    const milestone = getMilestone(params.milestoneId);
-    if (!milestone) {
-      guardError = `milestone not found: ${params.milestoneId}`;
-      return;
-    }
-    if (!isClosedStatus(milestone.status)) {
-      guardError = `milestone ${params.milestoneId} is not closed (status: ${milestone.status}) — nothing to reopen`;
-      return;
-    }
-
-    reopenMilestoneStatus(params.milestoneId);
-
-    const slices = getMilestoneSlices(params.milestoneId);
-    slicesResetCount = slices.length;
-
-    for (const slice of slices) {
-      updateSliceStatus(params.milestoneId, slice.id, "in_progress");
-      const tasks = getSliceTasks(params.milestoneId, slice.id);
-      tasksResetCount += tasks.length;
-      for (const task of tasks) {
-        updateTaskStatus(params.milestoneId, slice.id, task.id, "pending");
-      }
+  // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+  const outcome = reopenMilestoneCascade(params.milestoneId);
+  if (!outcome.ok) {
+    switch (outcome.reason) {
+      case "milestone-not-found":
+        return { error: `milestone not found: ${params.milestoneId}` };
+      case "milestone-not-closed":
+        return { error: `milestone ${params.milestoneId} is not closed (status: ${outcome.status}) — nothing to reopen` };
     }
-  });
-
-  if (guardError) {
-    return { error: guardError };
   }
+  const slicesResetCount = outcome.slicesReset;
+  const tasksResetCount = outcome.tasksReset;
 
   // ── Invalidate caches ────────────────────────────────────────────────────
   invalidateStateCache();

package/src/resources/extensions/gsd/tools/reopen-slice.ts

@@ -12,15 +12,10 @@
 // Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 
 import {
-  getMilestone,
-  getSlice,
   getSliceTasks,
-  updateSliceStatus,
-  updateTaskStatus,
-  transaction,
+  reopenSliceCascade,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -57,44 +52,21 @@ export async function handleReopenSlice(
     return { error: "milestoneId is required and must be a non-empty string" };
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-  let guardError: string | null = null;
-  let tasksResetCount = 0;
-
-  transaction(() => {
-    const milestone = getMilestone(params.milestoneId);
-    if (!milestone) {
-      guardError = `milestone not found: ${params.milestoneId}`;
-      return;
-    }
-    if (isClosedStatus(milestone.status)) {
-      guardError = `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-      return;
-    }
-
-    const slice = getSlice(params.milestoneId, params.sliceId);
-    if (!slice) {
-      guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
-      return;
-    }
-    if (!isClosedStatus(slice.status)) {
-      guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
-      return;
+  // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+  const outcome = reopenSliceCascade(params.milestoneId, params.sliceId);
+  if (!outcome.ok) {
+    switch (outcome.reason) {
+      case "milestone-not-found":
+        return { error: `milestone not found: ${params.milestoneId}` };
+      case "milestone-closed":
+        return { error: `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})` };
+      case "slice-not-found":
+        return { error: `slice not found: ${params.milestoneId}/${params.sliceId}` };
+      case "slice-not-complete":
+        return { error: `slice ${params.sliceId} is not complete (status: ${outcome.status}) — nothing to reopen` };
     }
-
-    // Fetch tasks inside txn so the list is consistent with the slice status check
-    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-    tasksResetCount = tasks.length;
-
-    updateSliceStatus(params.milestoneId, params.sliceId, "in_progress");
-    for (const task of tasks) {
-      updateTaskStatus(params.milestoneId, params.sliceId, task.id, "pending");
-    }
-  });
-
-  if (guardError) {
-    return { error: guardError };
   }
+  const tasksResetCount = outcome.tasksReset;
 
   // ── Invalidate caches ────────────────────────────────────────────────────
   invalidateStateCache();

package/src/resources/extensions/gsd/tools/skip-slice.ts

@@ -11,14 +11,9 @@
  */
 
 import {
-  getSlice,
-  getSliceTasks,
   isDbAvailable,
-  transaction,
-  updateSliceStatus,
-  updateTaskStatus,
+  skipSliceCascade,
 } from "../gsd-db.js";
-import { isClosedStatus } from "../status-guards.js";
 
 /**
  * Input parameters for {@link handleSkipSlice}.
@@ -90,44 +85,23 @@ export function handleSkipSlice(params: SkipSliceParams): SkipSliceResult {
     throw new Error("handleSkipSlice: GSD database is not available");
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ────
-  let guardError: string | null = null;
-  let guardCode: SkipSliceErrorCode | null = null;
-  let wasAlreadySkipped = false;
-  let tasksSkipped = 0;
-
-  transaction(() => {
-    const slice = getSlice(params.milestoneId, params.sliceId);
-    if (!slice) {
-      guardError = `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`;
-      guardCode = "slice_not_found";
-      return;
-    }
-    if (slice.status === "complete" || slice.status === "done") {
-      guardError = `Slice ${params.sliceId} is already complete — cannot skip.`;
-      guardCode = "already_complete";
-      return;
-    }
-
-    wasAlreadySkipped = slice.status === "skipped";
-    if (!wasAlreadySkipped) {
-      updateSliceStatus(params.milestoneId, params.sliceId, "skipped");
+  // ── Atomic skip cascade (guards + writes in one transaction) ────────────
+  const outcome = skipSliceCascade(params.milestoneId, params.sliceId);
+  if (!outcome.ok) {
+    switch (outcome.reason) {
+      case "slice-not-found":
+        return {
+          ...base,
+          error: `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`,
+          errorCode: "slice_not_found" as SkipSliceErrorCode,
+        };
+      case "slice-already-complete":
+        return {
+          ...base,
+          error: `Slice ${params.sliceId} is already complete — cannot skip.`,
+          errorCode: "already_complete" as SkipSliceErrorCode,
+        };
     }
-
-    // Cascade: mark every non-closed task as skipped so milestone completion
-    // doesn't trip the deep-task guard (#4375). Closed tasks (complete/done/
-    // skipped) are left untouched — we never downgrade.
-    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-    for (const task of tasks) {
-      if (!isClosedStatus(task.status)) {
-        updateTaskStatus(params.milestoneId, params.sliceId, task.id, "skipped");
-        tasksSkipped++;
-      }
-    }
-  });
-
-  if (guardError) {
-    return { ...base, error: guardError, errorCode: guardCode ?? undefined };
   }
-  return { ...base, tasksSkipped, wasAlreadySkipped };
+  return { ...base, tasksSkipped: outcome.tasksSkipped, wasAlreadySkipped: outcome.wasAlreadySkipped };
 }

package/src/resources/extensions/gsd/tools/workflow-tool-executors.ts

@@ -19,9 +19,10 @@ import {
 } from "../gsd-db.js";
 import { GATE_REGISTRY } from "../gate-registry.js";
 import { generateRequirementsMd, saveArtifactToDb } from "../db-writer.js";
-import { clearPathCache, relSliceFile, resolveGsdPathContract, resolveMilestoneFile, resolveSliceFile } from "../paths.js";
+import { clearPathCache, normalizeRealPath, relSliceFile, resolveGsdPathContract, resolveMilestoneFile, resolveSliceFile } from "../paths.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { unlinkSync } from "node:fs";
+import { hostname } from "node:os";
 import { join } from "node:path";
 import type { CompleteMilestoneParams } from "./complete-milestone.js";
 import { handleCompleteMilestone } from "./complete-milestone.js";
@@ -48,13 +49,21 @@ import { logError, logWarning } from "../workflow-logger.js";
 import { invalidateStateCache } from "../state.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { parseProject } from "../schemas/parsers.js";
-import { getAutoRuntimeSnapshot } from "../auto-runtime-state.js";
+import { autoSession, getAutoRuntimeSnapshot, isAutoActive } from "../auto-runtime-state.js";
 import { renderPlanFromDb } from "../markdown-renderer.js";
 import {
   prepareUatRun,
   saveUatAttemptArtifact,
   type UatResultSaveParams,
 } from "../uat-run.js";
+import { registerAutoWorker, markWorkerStopping, getAutoWorker } from "../db/auto-workers.js";
+import {
+  claimMilestoneLease,
+  releaseMilestoneLease,
+  getMilestoneLease,
+  refreshMilestoneLease,
+  milestoneLeaseTtlSeconds,
+} from "../db/milestone-leases.js";
 export type {
   UatCheckResultInput,
   UatEvidenceRef,
@@ -105,6 +114,24 @@ function blockIfWrongAutoUnit(requiredUnitType: string, operation: string): Tool
   };
 }
 
+function milestoneLeaseConflictResult(
+  milestoneId: string,
+  byWorker: string,
+  expiresAt: string,
+): ToolExecutionResult {
+  return {
+    content: [{ type: "text", text: `Milestone ${milestoneId} is currently leased by ${byWorker}. Retry after ${expiresAt}.` }],
+    details: {
+      operation: "plan_milestone",
+      error: "milestone_lease_conflict",
+      milestoneId,
+      byWorker,
+      expiresAt,
+    },
+    isError: true,
+  };
+}
+
 export interface SummarySaveParams {
   milestone_id?: string;
   slice_id?: string;
@@ -1244,7 +1271,48 @@ export async function executePlanMilestone(
     isError: true,
       };
   }
+  let workerId: string | null = null;
+  let acquiredToken: number | null = null;
+  let leaseRefreshTimer: ReturnType<typeof setInterval> | undefined;
   try {
+    // Re-read at the gate so a peer-created milestone is not treated as fresh.
+    const milestoneExists = getMilestone(params.milestoneId) !== null;
+    if (milestoneExists) {
+      const heldLease = getMilestoneLease(params.milestoneId);
+      if (heldLease?.status === "held" && Date.parse(heldLease.expires_at) > Date.now()) {
+        const holder = getAutoWorker(heldLease.worker_id);
+        // Let the one-shot claim path recover stale same-process worker rows.
+        const projectRoot = normalizeRealPath(basePath);
+        const isOurAutoLease = isAutoActive() && heldLease.worker_id === autoSession.workerId;
+        const holderIsOneShotReentrantPeer = !isAutoActive()
+          && !!holder
+          && holder.host === hostname()
+          && holder.pid === process.pid
+          && holder.project_root_realpath === projectRoot;
+        if (holder?.status === "active" && !isOurAutoLease && !holderIsOneShotReentrantPeer) {
+          return milestoneLeaseConflictResult(params.milestoneId, heldLease.worker_id, heldLease.expires_at);
+        }
+      }
+    }
+
+    // Fresh creation cannot claim a lease because the FK row does not exist.
+    // In-process auto already owns its lease; re-claiming would bump its token.
+    if (!isAutoActive() && milestoneExists) {
+      workerId = registerAutoWorker({ projectRootRealpath: normalizeRealPath(basePath) });
+      const lease = claimMilestoneLease(workerId, params.milestoneId);
+      if (!lease.ok) {
+        return milestoneLeaseConflictResult(params.milestoneId, lease.byWorker, lease.expiresAt);
+      }
+      acquiredToken = lease.token;
+
+      const leaseRefreshMs = (milestoneLeaseTtlSeconds() / 2) * 1000;
+      leaseRefreshTimer = setInterval(() => {
+        if (acquiredToken !== null && workerId !== null) {
+          refreshMilestoneLease(workerId, params.milestoneId, acquiredToken);
+        }
+      }, leaseRefreshMs);
+    }
+
     const result = await handlePlanMilestone(params, basePath);
     if ("error" in result) {
       return {
@@ -1270,6 +1338,17 @@ export async function executePlanMilestone(
     isError: true,
       };
   }
+  finally {
+    if (leaseRefreshTimer !== undefined) {
+      clearInterval(leaseRefreshTimer);
+    }
+    if (workerId !== null && acquiredToken !== null) {
+      releaseMilestoneLease(workerId, params.milestoneId, acquiredToken);
+    }
+    if (workerId !== null) {
+      markWorkerStopping(workerId);
+    }
+  }
 }
 
 export async function executePlanSlice(