gsd-pi 2.80.0-dev.3065f7bfa → 2.80.0-dev.488219eb6

package/src/resources/extensions/claude-code-cli/readiness.ts

@@ -25,11 +25,20 @@ import { execFileSync } from "node:child_process";
  * we invoke `cmd /c <command> <args...>` explicitly. On POSIX we don't
  * need a shell at all.
  */
-function spawnClaude(command: string, args: string[], opts: { timeout: number; stdio: "pipe" }): Buffer {
-	if (process.platform === "win32") {
-		return execFileSync("cmd", ["/c", command, ...args], opts);
+export function buildClaudeSpawnInvocation(
+	command: string,
+	args: string[],
+	platform: NodeJS.Platform = process.platform,
+): { command: string; args: string[] } {
+	if (platform === "win32") {
+		return { command: "cmd", args: ["/c", command, ...args] };
 	}
-	return execFileSync(command, args, opts);
+	return { command, args };
+}
+
+function spawnClaude(command: string, args: string[], opts: { timeout: number; stdio: "pipe" }): Buffer {
+	const invocation = buildClaudeSpawnInvocation(command, args);
+	return execFileSync(invocation.command, invocation.args, opts);
 }
 
 /**
@@ -38,7 +47,11 @@ function spawnClaude(command: string, args: string[], opts: { timeout: number; s
  * Keep the explicit win32 ternary selector for regression coverage (Issue #4424):
  * Node's execFileSync must target `claude.cmd` directly on Windows.
  */
-const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
+export function getClaudeCommand(platform: NodeJS.Platform = process.platform): string {
+	return platform === "win32" ? "claude.cmd" : "claude";
+}
+
+const CLAUDE_COMMAND = getClaudeCommand();
 
 /**
  * Windows installs vary: some environments expose `claude.cmd` (npm shim),
@@ -46,7 +59,12 @@ const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
  * (for example Git Bash wrappers). Try all three to avoid false "not
  * installed" results in readiness checks.
  */
-const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
+export function getClaudeCommandCandidates(platform: NodeJS.Platform = process.platform): string[] {
+	const command = getClaudeCommand(platform);
+	return platform === "win32" ? [command, "claude.exe", "claude"] : [command];
+}
+
+const CLAUDE_COMMAND_CANDIDATES = getClaudeCommandCandidates();
 
 // Keep the version probe snappy — `claude --version` is a quick path.
 const VERSION_TIMEOUT_MS = 5_000;
@@ -97,7 +115,7 @@ function findWorkingCommand(): string | null {
  * back to a text heuristic. Note: the text heuristic only covers English
  * phrasing — the JSON path is the durable signal.
  */
-function parseAuthStatus(output: string): boolean | null {
+export function parseAuthStatus(output: string): boolean | null {
 	const trimmed = output.trim();
 	if (!trimmed) return null;
 

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -418,6 +418,27 @@ function makeErrorMessage(model: string, errorMsg: string): AssistantMessage {
 	};
 }
 
+export function isClaudeCodeAbortErrorMessage(message: string | undefined | null): boolean {
+	if (!message) return false;
+	return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
+}
+
+function isBareClaudeCodeAbortErrorMessage(message: string | undefined | null): boolean {
+	if (!message) return false;
+	const normalized = message.trim().replace(/\s+/g, " ").toLowerCase();
+	return normalized === "claude code process aborted by user"
+		|| normalized === "request aborted by user"
+		|| normalized === "process aborted by user";
+}
+
+export function resolveClaudeCodeAbortedMessageText(errorMsg: string, lastTextContent: string): string {
+	const trimmedError = errorMsg.trim();
+	if (trimmedError && !isBareClaudeCodeAbortErrorMessage(trimmedError)) {
+		return trimmedError;
+	}
+	return lastTextContent;
+}
+
 /**
  * Generator exhaustion without a terminal result means the SDK stream was
  * interrupted mid-turn. Surface it as an error so downstream recovery logic
@@ -1840,6 +1861,15 @@ async function pumpSdkMessages(
 		stream.push({ type: "error", reason: "error", error: fallback });
 	} catch (err) {
 		const errorMsg = err instanceof Error ? err.message : String(err);
+		if (options?.signal?.aborted || isClaudeCodeAbortErrorMessage(errorMsg)) {
+			const abortedText = resolveClaudeCodeAbortedMessageText(errorMsg, lastTextContent);
+			stream.push({
+				type: "error",
+				reason: "aborted",
+				error: makeAbortedMessage(modelId, abortedText),
+			});
+			return;
+		}
 		stream.push({
 			type: "error",
 			reason: "error",

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -5,6 +5,8 @@ import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import {
 	makeStreamExhaustedErrorMessage,
+	isClaudeCodeAbortErrorMessage,
+	resolveClaudeCodeAbortedMessageText,
 	getResultErrorMessage,
 	makeAbortedMessage,
 	mergePendingToolCalls,
@@ -1212,6 +1214,12 @@ describe("stream-adapter — MCP elicitation bridge", () => {
 // ---------------------------------------------------------------------------
 
 describe("stream-adapter — abort classification (F2)", () => {
+	test("recognizes Claude Code SDK abort exceptions", () => {
+		assert.equal(isClaudeCodeAbortErrorMessage("Claude Code process aborted by user"), true);
+		assert.equal(isClaudeCodeAbortErrorMessage("Request aborted by user"), true);
+		assert.equal(isClaudeCodeAbortErrorMessage("rate limit exceeded"), false);
+	});
+
 	test("makeAbortedMessage sets stopReason to 'aborted', not 'error'", () => {
 		const message = makeAbortedMessage("claude-sonnet-4-6", "");
 		assert.equal(message.stopReason, "aborted");
@@ -1229,6 +1237,24 @@ describe("stream-adapter — abort classification (F2)", () => {
 		assert.notEqual(aborted.stopReason, exhausted.stopReason);
 		assert.equal(exhausted.errorMessage, "stream_exhausted_without_result");
 	});
+
+	test("abort catch preserves SDK diagnostic text instead of partial output", () => {
+		const text = resolveClaudeCodeAbortedMessageText(
+			"Request aborted by user\nAPI Error: 529 overloaded",
+			"partial mid-stream text",
+		);
+
+		assert.equal(text, "Request aborted by user\nAPI Error: 529 overloaded");
+	});
+
+	test("abort catch falls back to partial output for bare abort markers", () => {
+		const text = resolveClaudeCodeAbortedMessageText(
+			"Request aborted by user",
+			"partial mid-stream text",
+		);
+
+		assert.equal(text, "partial mid-stream text");
+	});
 });
 
 // ---------------------------------------------------------------------------

package/src/resources/extensions/github-sync/sync.ts

@@ -122,6 +122,13 @@ export async function runGitHubSync(
   }
 }
 
+export function shouldCreateSlicePrForSyncEvent(
+  unitType: string,
+  config: Pick<GitHubSyncConfig, "slice_prs">,
+): boolean {
+  return unitType === "complete-slice" && config.slice_prs !== false;
+}
+
 // ─── Per-Event Sync Functions ───────────────────────────────────────────────
 
 async function syncMilestonePlan(
@@ -406,7 +413,7 @@ async function syncSliceComplete(
     sliceRecord = getSliceRecord(mapping, mid, sid);
   }
   if (!sliceRecord || sliceRecord.state === "closed") return;
-  if (!sliceRecord.prNumber && config.slice_prs !== false) {
+  if (!sliceRecord.prNumber && shouldCreateSlicePrForSyncEvent("complete-slice", config)) {
     await ensureSlicePullRequest(basePath, mapping, mid, sid);
     sliceRecord = getSliceRecord(mapping, mid, sid);
     if (!sliceRecord || !sliceRecord.prNumber) return;

package/src/resources/extensions/github-sync/tests/sync-source.test.ts

@@ -1,26 +1,14 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const source = readFileSync(join(import.meta.dirname, "..", "sync.ts"), "utf8");
+import { shouldCreateSlicePrForSyncEvent } from "../sync.ts";
 
 test("slice plan sync records issues without creating a draft PR", () => {
-	const planStart = source.indexOf("async function syncSlicePlan");
-	const prHelperStart = source.indexOf("async function ensureSlicePullRequest");
-	assert.ok(planStart >= 0 && prHelperStart > planStart, "slice plan and PR helper functions are present");
-
-	const planBody = source.slice(planStart, prHelperStart);
-	assert.match(planBody, /prNumber:\s*0/);
-	assert.doesNotMatch(planBody, /ghCreatePR\(/);
-	assert.doesNotMatch(planBody, /ghPushBranch\(/);
+	assert.equal(shouldCreateSlicePrForSyncEvent("plan-slice", { slice_prs: true }), false);
+	assert.equal(shouldCreateSlicePrForSyncEvent("research-slice", { slice_prs: true }), false);
 });
 
 test("slice completion creates the PR only after slice work is complete", () => {
-	const completeStart = source.indexOf("async function syncSliceComplete");
-	const milestoneStart = source.indexOf("async function syncMilestoneComplete");
-	assert.ok(completeStart >= 0 && milestoneStart > completeStart, "slice complete function is present");
-
-	const completeBody = source.slice(completeStart, milestoneStart);
-	assert.match(completeBody, /ensureSlicePullRequest\(basePath, mapping, mid, sid\)/);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", { slice_prs: true }), true);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", {}), true);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", { slice_prs: false }), false);
 });

package/src/resources/extensions/gsd/auto/loop.ts

@@ -38,7 +38,7 @@ import {
   getRecentForUnit as getRecentDispatchesForUnit,
   getRecentUnitKeysForProjectRoot,
 } from "../db/unit-dispatches.js";
-import { refreshMilestoneLease } from "../db/milestone-leases.js";
+import { claimMilestoneLease, refreshMilestoneLease } from "../db/milestone-leases.js";
 import { heartbeatAutoWorker } from "../db/auto-workers.js";
 import { getRuntimeKv, setRuntimeKv } from "../db/runtime-kv.js";
 import { resolveUokFlags } from "../uok/flags.js";
@@ -70,7 +70,7 @@ import {
 } from "./workflow-dispatch-ledger.js";
 import { emitOpenUnitEndForUnit } from "../crash-recovery.js";
 import { writeUnitRuntimeRecord } from "../unit-runtime.js";
-import { openDispatchClaim } from "./workflow-dispatch-claim.js";
+import { ensureDispatchLease, openDispatchClaim } from "./workflow-dispatch-claim.js";
 import { completeWorkflowIteration } from "./workflow-iteration-completion.js";
 import { createWorkflowJournalReporter } from "./workflow-journal-reporter.js";
 import { createWorkflowPhaseReporter } from "./workflow-phase-reporter.js";
@@ -165,6 +165,29 @@ function logDispatchClaimFailed(err: unknown): void {
   });
 }
 
+function logDispatchLeaseRecovered(details: {
+  milestoneId: string;
+  workerId: string;
+  token: number;
+  recovered: boolean;
+}): void {
+  debugLog("autoLoop", {
+    phase: details.recovered ? "dispatch-lease-recovered" : "dispatch-lease-acquired",
+    ...details,
+  });
+}
+
+function logDispatchLeaseRecoveryFailed(details: {
+  milestoneId?: string;
+  workerId?: string;
+  reason: string;
+}): void {
+  debugLog("autoLoop", {
+    phase: "dispatch-lease-recovery-failed",
+    ...details,
+  });
+}
+
 function logCustomVerifyRetryLoadFailure(err: unknown): void {
   debugLog("autoLoop", {
     phase: "load-custom-verify-retries-failed",
@@ -274,6 +297,10 @@ export async function autoLoop(
         phase: "heartbeat-failed",
         error: err instanceof Error ? err.message : String(err),
       }),
+      logLeaseRefreshMiss: details => debugLog("autoLoop", {
+        phase: "lease-refresh-missed",
+        ...details,
+      }),
     });
 
     // ── Journal: per-iteration flow grouping ──
@@ -703,25 +730,74 @@ export async function autoLoop(
 
       // Phase B: claim a unit_dispatches row before invoking the unit. The
       // partial unique index idx_unit_dispatches_active_per_unit prevents
-      // a second worker from claiming the same unit concurrently. Returns
-      // null when DB unavailable, no worker registered, or no active lease
-      // — those degraded paths fall through to the existing single-worker
-      // semantics with no ledger entry, preserving back-compat.
-      const dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+      // a second worker from claiming the same unit concurrently. When this
+      // process has a worker identity, make the milestone lease explicit before
+      // claiming so a step-mode handoff cannot leave us running with a stale
+      // in-memory token and no backing lease row.
+      const leaseBeforeClaim = ensureDispatchLease(s, iterData.mid, {
+        claimMilestoneLease,
+        logLeaseRecovered: logDispatchLeaseRecovered,
+        logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+      });
+      if (leaseBeforeClaim.kind === "blocked" || leaseBeforeClaim.kind === "failed") {
+        const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} before dispatching ${iterData.unitType} ${iterData.unitId}: ${leaseBeforeClaim.reason}`;
+        ctx.ui.notify(msg, "error");
+        finishTurn("stopped", "execution", msg);
+        await deps.stopAuto(ctx, pi, msg);
+        break;
+      }
+
+      let dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
         getRecentDispatchesForUnit,
         recordDispatchClaim,
         markDispatchRunning,
         logClaimRejected: logDispatchClaimRejected,
         logClaimFailed: logDispatchClaimFailed,
       });
-      const dispatchDecision = decideDispatchClaim(
+      let dispatchDecision = decideDispatchClaim(
         dispatchClaim.kind === "opened"
           ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
           : dispatchClaim.kind === "skip"
             ? { kind: "skip", reason: dispatchClaim.reason }
             : { kind: "degraded" },
       );
+      if (dispatchDecision.action === "skip" && dispatchDecision.reason === "stale-lease") {
+        const leaseRecovery = ensureDispatchLease(s, iterData.mid, {
+          claimMilestoneLease,
+          logLeaseRecovered: logDispatchLeaseRecovered,
+          logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+        }, { forceReclaim: true });
+        if (leaseRecovery.kind === "ready") {
+          dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+            getRecentDispatchesForUnit,
+            recordDispatchClaim,
+            markDispatchRunning,
+            logClaimRejected: logDispatchClaimRejected,
+            logClaimFailed: logDispatchClaimFailed,
+          });
+          dispatchDecision = decideDispatchClaim(
+            dispatchClaim.kind === "opened"
+              ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
+              : dispatchClaim.kind === "skip"
+                ? { kind: "skip", reason: dispatchClaim.reason }
+                : { kind: "degraded" },
+          );
+        } else {
+          const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}: ${leaseRecovery.reason}`;
+          ctx.ui.notify(msg, "error");
+          finishTurn("stopped", "execution", msg);
+          await deps.stopAuto(ctx, pi, msg);
+          break;
+        }
+      }
       if (dispatchDecision.action === "skip") {
+        if (dispatchDecision.reason === "stale-lease") {
+          const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}; dispatch claim still failed after recovery.`;
+          ctx.ui.notify(msg, "error");
+          finishTurn("stopped", "execution", msg);
+          await deps.stopAuto(ctx, pi, msg);
+          break;
+        }
         finishTurn("skipped", "execution", dispatchDecision.reason);
         continue;
       }

package/src/resources/extensions/gsd/auto/phases.ts

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-loop pipeline phases, merge closeout, and finalize handling.
 /**
  * auto/phases.ts — Pipeline phases for the auto-loop.
  *
@@ -126,10 +128,23 @@ const PLAN_V2_GATE_PHASES: ReadonlySet<Phase> = new Set([
   "completing-milestone",
 ]);
 
-function shouldRunPlanV2Gate(phase: Phase): boolean {
+export function shouldRunPlanV2Gate(phase: Phase): boolean {
   return PLAN_V2_GATE_PHASES.has(phase);
 }
 
+export function _shouldProceedWithInvalidRepoClassificationForTest(
+  reason: string | undefined,
+  hasGit: boolean,
+): boolean {
+  return reason === "missing .git" && hasGit;
+}
+
+export function _resolveCurrentUnitStartedAtForTest(
+  currentUnit: { startedAt: number } | null | undefined,
+): number | undefined {
+  return currentUnit?.startedAt;
+}
+
 /**
  * Generate and write an HTML milestone report snapshot.
  * Extracted from the milestone-transition block in autoLoop.
@@ -332,6 +347,21 @@ export async function _runMilestoneMergeWithStashRestore(
   return null;
 }
 
+export async function _runMilestoneMergeOnceWithStashRestore(
+  ic: IterationContext,
+  milestoneId: string,
+): Promise<{ action: "break"; reason: string } | null> {
+  if (ic.s.milestoneMergedInPhases) {
+    debugLog("autoLoop", {
+      phase: "milestone-merge-skip",
+      reason: "already-merged-in-phases",
+      milestoneId,
+    });
+    return null;
+  }
+  return _runMilestoneMergeWithStashRestore(ic, milestoneId);
+}
+
 async function emitCancelledUnitEnd(
   ic: IterationContext,
   unitType: string,
@@ -771,7 +801,7 @@ export async function runPreDispatch(
     // Worktree lifecycle on milestone transition — merge current, enter next.
     // #2909 / #5538-followup: preflight stash + always-on postflight pop.
     {
-      const stop = await _runMilestoneMergeWithStashRestore(ic, s.currentMilestoneId!);
+      const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId!);
       if (stop) return stop;
     }
 
@@ -853,7 +883,7 @@ export async function runPreDispatch(
       // All milestones complete — merge milestone branch before stopping.
       if (s.currentMilestoneId) {
         // #2909 / #5538-followup: preflight stash + always-on postflight pop.
-        const stop = await _runMilestoneMergeWithStashRestore(ic, s.currentMilestoneId);
+        const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
         if (stop) return stop;
         // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
       }
@@ -948,7 +978,7 @@ export async function runPreDispatch(
     // Milestone merge on complete (before closeout so branch state is clean).
     if (s.currentMilestoneId) {
       // #2909 / #5538-followup: preflight stash + always-on postflight pop.
-      const stop = await _runMilestoneMergeWithStashRestore(ic, s.currentMilestoneId);
+      const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
       if (stop) return stop;
       // PR creation (auto_pr) is handled inside mergeMilestoneToMain (#2302)
     }
@@ -1553,7 +1583,7 @@ export async function runUnitPhase(
     if (projectClassification.kind === "invalid-repo") {
       const msg = `Worktree health check failed: ${s.basePath} classified as invalid-repo (${projectClassification.reason}) — refusing to dispatch ${unitType} ${unitId}`;
       debugLog("runUnitPhase", { phase: "worktree-health-invalid-repo", basePath: s.basePath, classification: projectClassification });
-      if (projectClassification.reason === "missing .git" && hasGit) {
+      if (_shouldProceedWithInvalidRepoClassificationForTest(projectClassification.reason, hasGit)) {
         ctx.ui.notify(
           `Warning: ${s.basePath} project classification could not confirm .git; assuming it has no project content yet — proceeding as greenfield project because worktree health reported .git present`,
           "warning",
@@ -2068,7 +2098,7 @@ export async function runUnitPhase(
     const currentLedger = deps.getLedger() as { units: Array<{ type: string; id: string; startedAt: number; toolCalls: number }> } | null;
     if (currentLedger?.units) {
       const lastUnit = [...currentLedger.units].reverse().find(
-        (u: { type: string; id: string; startedAt: number; toolCalls: number }) => u.type === unitType && u.id === unitId && u.startedAt === s.currentUnit?.startedAt,
+        (u: { type: string; id: string; startedAt: number; toolCalls: number }) => u.type === unitType && u.id === unitId && u.startedAt === _resolveCurrentUnitStartedAtForTest(s.currentUnit),
       );
       if (lastUnit && lastUnit.toolCalls === 0) {
         if (USER_DRIVEN_DEEP_UNITS.has(unitType) && isAwaitingUserInput(s.lastUnitAgentEndMessages ?? undefined)) {
@@ -2090,7 +2120,7 @@ export async function runUnitPhase(
           );
           // Fall through to next iteration where dispatch will re-derive
           // and re-dispatch this unit.
-          return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
+          return { action: "next", data: { unitStartedAt: _resolveCurrentUnitStartedAtForTest(s.currentUnit), requestDispatchedAt: unitResult.requestDispatchedAt } };
         }
       }
     }
@@ -2155,7 +2185,7 @@ export async function runUnitPhase(
     s.checkpointSha = null;
   }
 
-  return { action: "next", data: { unitStartedAt: s.currentUnit?.startedAt, requestDispatchedAt: unitResult.requestDispatchedAt } };
+  return { action: "next", data: { unitStartedAt: _resolveCurrentUnitStartedAtForTest(s.currentUnit), requestDispatchedAt: unitResult.requestDispatchedAt } };
 }
 
 // ─── runFinalize ──────────────────────────────────────────────────────────────
@@ -2335,6 +2365,11 @@ export async function runFinalize(
     return { action: "break", reason: "step-wizard" };
   }
 
+  if (preUnitSnapshot?.type === "complete-milestone" && s.currentMilestoneId) {
+    const stop = await _runMilestoneMergeOnceWithStashRestore(ic, s.currentMilestoneId);
+    if (stop) return stop;
+  }
+
   // Both pre and post verification completed without timeout — reset counter
   loopState.consecutiveFinalizeTimeouts = 0;
   if (preUnitSnapshot) {

package/src/resources/extensions/gsd/auto/resolve.ts

@@ -23,6 +23,9 @@ import { bumpTurnGeneration } from "./turn-epoch.js";
 let _currentResolve: ((result: UnitResult) => void) | null = null;
 let _sessionSwitchInFlight = false;
 let _pendingSwitchCancellation: { errorContext?: ErrorContext } | null = null;
+let _sessionSwitchAbortGraceUntil = 0;
+
+const DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS = 2_000;
 
 // ─── Setters (needed for cross-module mutation) ─────────────────────────────
 
@@ -34,6 +37,21 @@ export function _setSessionSwitchInFlight(v: boolean): void {
   _sessionSwitchInFlight = v;
 }
 
+export function _markSessionSwitchAbortGraceWindow(durationMs = DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS): void {
+  _sessionSwitchAbortGraceUntil = Math.max(
+    _sessionSwitchAbortGraceUntil,
+    Date.now() + durationMs,
+  );
+}
+
+export function _clearSessionSwitchAbortGraceWindow(): void {
+  _sessionSwitchAbortGraceUntil = 0;
+}
+
+export function isSessionSwitchAbortGraceActive(now = Date.now()): boolean {
+  return now < _sessionSwitchAbortGraceUntil;
+}
+
 export function _clearCurrentResolve(): void {
   _currentResolve = null;
 }
@@ -142,6 +160,7 @@ export function _resetPendingResolve(): void {
   _currentResolve = null;
   _sessionSwitchInFlight = false;
   _pendingSwitchCancellation = null;
+  _sessionSwitchAbortGraceUntil = 0;
 }
 
 export function _hasPendingResolveForTest(): boolean {

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -14,6 +14,7 @@ import type { UnitResult } from "./types.js";
 import {
   _clearCurrentResolve,
   _consumePendingSwitchCancellation,
+  _markSessionSwitchAbortGraceWindow,
   _setCurrentResolve,
   _setSessionSwitchInFlight,
 } from "./resolve.js";
@@ -65,6 +66,7 @@ export async function runUnit(
       workspaceRoot: s.basePath,
     }).finally(() => {
       if (sessionSwitchGeneration === mySessionSwitchGeneration) {
+        _markSessionSwitchAbortGraceWindow();
         _setSessionSwitchInFlight(false);
       }
     });
@@ -128,6 +130,7 @@ export async function runUnit(
   // ── Create the agent_end promise (per-unit one-shot) ──
   // This happens after newSession completes so session-switch agent_end events
   // from the previous session cannot resolve the new unit.
+  _markSessionSwitchAbortGraceWindow();
   _setSessionSwitchInFlight(false);
   const unitPromise = new Promise<UnitResult>((resolve) => {
     _setCurrentResolve(resolve);

package/src/resources/extensions/gsd/auto/workflow-dispatch-claim.ts

@@ -9,6 +9,16 @@ export type DispatchClaimOutcome =
   | { kind: "skip"; reason: "already-active" | "stale-lease"; existingId?: number; existingWorker?: string }
   | { kind: "degraded" };
 
+export type DispatchLeaseOutcome =
+  | { kind: "ready"; token: number; recovered: boolean }
+  | { kind: "degraded"; reason: "missing-worker" | "missing-milestone" }
+  | { kind: "blocked"; reason: string }
+  | { kind: "failed"; reason: string };
+
+type ClaimMilestoneLeaseResult =
+  | { ok: true; token: number; expiresAt: string }
+  | { ok: false; error: "held_by"; byWorker: string; expiresAt: string };
+
 interface RecentDispatch {
   attempt_n?: number | null;
 }
@@ -44,6 +54,58 @@ export interface OpenDispatchClaimDeps {
   logClaimFailed: (err: unknown) => void;
 }
 
+export interface EnsureDispatchLeaseDeps {
+  claimMilestoneLease: (workerId: string, milestoneId: string) => ClaimMilestoneLeaseResult;
+  logLeaseRecovered: (details: {
+    milestoneId: string;
+    workerId: string;
+    token: number;
+    recovered: boolean;
+  }) => void;
+  logLeaseRecoveryFailed: (details: {
+    milestoneId?: string;
+    workerId?: string;
+    reason: string;
+  }) => void;
+}
+
+export function ensureDispatchLease(
+  s: AutoSession,
+  milestoneId: string | undefined,
+  deps: EnsureDispatchLeaseDeps,
+  opts: { forceReclaim?: boolean } = {},
+): DispatchLeaseOutcome {
+  if (!s.workerId) return { kind: "degraded", reason: "missing-worker" };
+  if (!milestoneId) return { kind: "degraded", reason: "missing-milestone" };
+  if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+    return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+  }
+
+  s.milestoneLeaseToken = null;
+  try {
+    const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+    if (!claim.ok) {
+      const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+      deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+      return { kind: "blocked", reason };
+    }
+
+    s.currentMilestoneId = milestoneId;
+    s.milestoneLeaseToken = claim.token;
+    deps.logLeaseRecovered({
+      milestoneId,
+      workerId: s.workerId,
+      token: claim.token,
+      recovered: opts.forceReclaim === true,
+    });
+    return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+    return { kind: "failed", reason };
+  }
+}
+
 export function openDispatchClaim(
   s: AutoSession,
   flowId: string,
@@ -51,7 +113,7 @@ export function openDispatchClaim(
   iterData: IterationData,
   deps: OpenDispatchClaimDeps,
 ): DispatchClaimOutcome {
-  if (!s.workerId || s.milestoneLeaseToken === null) return { kind: "degraded" };
+  if (!s.workerId || typeof s.milestoneLeaseToken !== "number") return { kind: "degraded" };
   const mid = iterData.mid;
   if (!mid) return { kind: "degraded" };
 

package/src/resources/extensions/gsd/auto/workflow-worker-heartbeat.ts

@@ -15,6 +15,11 @@ export interface MaintainWorkerHeartbeatDeps {
     fencingToken: number,
   ) => boolean;
   logHeartbeatFailure: (err: unknown) => void;
+  logLeaseRefreshMiss?: (details: {
+    workerId: string;
+    milestoneId: string;
+    fencingToken: number;
+  }) => void;
 }
 
 export function maintainWorkerHeartbeat(
@@ -26,11 +31,19 @@ export function maintainWorkerHeartbeat(
   try {
     deps.heartbeatAutoWorker(session.workerId);
     if (session.currentMilestoneId && session.milestoneLeaseToken) {
-      deps.refreshMilestoneLease(
+      const refreshed = deps.refreshMilestoneLease(
         session.workerId,
         session.currentMilestoneId,
         session.milestoneLeaseToken,
       );
+      if (!refreshed) {
+        deps.logLeaseRefreshMiss?.({
+          workerId: session.workerId,
+          milestoneId: session.currentMilestoneId,
+          fencingToken: session.milestoneLeaseToken,
+        });
+        session.milestoneLeaseToken = null;
+      }
     }
   } catch (err) {
     deps.logHeartbeatFailure(err);