gsd-pi 2.80.0-dev.8b3a59f5c → 2.80.0-dev.a947d025c

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -1,3 +1,4 @@
+// GSD2 - Claude Code CLI provider stream adapter
 /**
  * Stream adapter: bridges the Claude Agent SDK into GSD's streamSimple contract.
  *
@@ -61,6 +62,11 @@ interface ClaudeCodeStreamOptions extends SimpleStreamOptions {
 	extensionUIContext?: ExtensionUIContext;
 }
 
+/** Resolve the workspace root for local Claude Code process execution. */
+export function resolveClaudeCodeCwd(options?: SimpleStreamOptions): string {
+	return options?.cwd && options.cwd.trim().length > 0 ? options.cwd : process.cwd();
+}
+
 /** A single selectable option within an SDK elicitation schema field. */
 interface SdkElicitationRequestOption {
 	const?: string;
@@ -418,6 +424,27 @@ function makeErrorMessage(model: string, errorMsg: string): AssistantMessage {
 	};
 }
 
+export function isClaudeCodeAbortErrorMessage(message: string | undefined | null): boolean {
+	if (!message) return false;
+	return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
+}
+
+function isBareClaudeCodeAbortErrorMessage(message: string | undefined | null): boolean {
+	if (!message) return false;
+	const normalized = message.trim().replace(/\s+/g, " ").toLowerCase();
+	return normalized === "claude code process aborted by user"
+		|| normalized === "request aborted by user"
+		|| normalized === "process aborted by user";
+}
+
+export function resolveClaudeCodeAbortedMessageText(errorMsg: string, lastTextContent: string): string {
+	const trimmedError = errorMsg.trim();
+	if (trimmedError && !isBareClaudeCodeAbortErrorMessage(trimmedError)) {
+		return trimmedError;
+	}
+	return lastTextContent;
+}
+
 /**
  * Generator exhaustion without a terminal result means the SDK stream was
  * interrupted mid-turn. Surface it as an error so downstream recovery logic
@@ -1286,8 +1313,9 @@ export function buildSdkOptions(
 	overrides?: { permissionMode?: "bypassPermissions" | "acceptEdits" | "default" | "plan" },
 	extraOptions: Record<string, unknown> & { reasoning?: ThinkingLevel } = {},
 ): Record<string, unknown> {
-	const { reasoning, ...sdkExtraOptions } = extraOptions;
-	const mcpServers = buildWorkflowMcpServers();
+	const { reasoning, cwd, ...sdkExtraOptions } = extraOptions;
+	const sdkCwd = typeof cwd === "string" && cwd.trim().length > 0 ? cwd : process.cwd();
+	const mcpServers = buildWorkflowMcpServers(sdkCwd);
 	const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
 	// Globally unblock the tools GSD expects Claude Code to run. When the
 	// workflow MCP server is available, prefer its `ask_user_questions` tool over
@@ -1328,7 +1356,7 @@ export function buildSdkOptions(
 		model: modelId,
 		includePartialMessages: true,
 		persistSession: true,
-		cwd: process.cwd(),
+		cwd: sdkCwd,
 		permissionMode,
 		allowDangerouslySkipPermissions: permissionMode === "bypassPermissions",
 		settingSources: ["project"],
@@ -1640,6 +1668,7 @@ async function pumpSdkMessages(
 		const queryPrompt = buildSdkQueryPrompt(context, prompt);
 		const permissionMode = await resolveClaudePermissionMode();
 		const uiContext = (options as ClaudeCodeStreamOptions | undefined)?.extensionUIContext;
+		const cwd = resolveClaudeCodeCwd(options);
 		const canUseToolHandler = createClaudeCodeCanUseToolHandler(uiContext);
 		// When no UI is available (headless / auto-mode), auto-approve all
 		// tool requests. This replaces the old bypassPermissions workaround.
@@ -1651,6 +1680,7 @@ async function pumpSdkMessages(
 			prompt,
 			{ permissionMode },
 			{
+				cwd,
 				reasoning: options?.reasoning,
 				canUseTool: canUseToolFallback,
 				...(uiContext
@@ -1840,6 +1870,15 @@ async function pumpSdkMessages(
 		stream.push({ type: "error", reason: "error", error: fallback });
 	} catch (err) {
 		const errorMsg = err instanceof Error ? err.message : String(err);
+		if (options?.signal?.aborted || isClaudeCodeAbortErrorMessage(errorMsg)) {
+			const abortedText = resolveClaudeCodeAbortedMessageText(errorMsg, lastTextContent);
+			stream.push({
+				type: "error",
+				reason: "aborted",
+				error: makeAbortedMessage(modelId, abortedText),
+			});
+			return;
+		}
 		stream.push({
 			type: "error",
 			reason: "error",

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -1,3 +1,4 @@
+// GSD2 - Claude Code stream adapter regression tests
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
 import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
@@ -5,6 +6,8 @@ import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import {
 	makeStreamExhaustedErrorMessage,
+	isClaudeCodeAbortErrorMessage,
+	resolveClaudeCodeAbortedMessageText,
 	getResultErrorMessage,
 	makeAbortedMessage,
 	mergePendingToolCalls,
@@ -13,6 +16,7 @@ import {
 	buildPromptFromContext,
 	buildSdkQueryPrompt,
 	buildSdkOptions,
+	resolveClaudeCodeCwd,
 	createClaudeCodeCanUseToolHandler,
 	buildBashPermissionPattern,
 	buildBashPermissionPatternOptions,
@@ -669,6 +673,45 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		assert.equal(options.model, "claude-sonnet-4-20250514");
 	});
 
+	test("buildSdkOptions prefers explicit cwd over process cwd for local SDK execution", () => {
+		const explicitCwd = "/tmp/gsd-session-root";
+		const options = buildSdkOptions("claude-sonnet-4-20250514", "hello world", undefined, { cwd: explicitCwd });
+		assert.equal(options.cwd, explicitCwd);
+	});
+
+	test("buildSdkOptions uses explicit cwd when auto-detecting workflow MCP launch config", () => {
+		const explicitCwd = realpathSync(mkdtempSync(join(tmpdir(), "claude-sdk-cwd-")));
+		const restore = setWorkflowMcpEnv({});
+		try {
+			delete process.env.GSD_WORKFLOW_MCP_COMMAND;
+			delete process.env.GSD_WORKFLOW_MCP_NAME;
+			delete process.env.GSD_WORKFLOW_MCP_ARGS;
+			delete process.env.GSD_WORKFLOW_MCP_ENV;
+			delete process.env.GSD_WORKFLOW_MCP_CWD;
+
+			const distDir = join(explicitCwd, "packages", "mcp-server", "dist");
+			mkdirSync(distDir, { recursive: true });
+			writeFileSync(join(distDir, "cli.js"), "#!/usr/bin/env node\n");
+
+			const options = buildSdkOptions("claude-sonnet-4-20250514", "hello world", undefined, { cwd: explicitCwd });
+			const mcpServers = options.mcpServers as Record<string, any>;
+			assert.equal(mcpServers["gsd-workflow"].cwd, explicitCwd);
+			assert.equal(mcpServers["gsd-workflow"].env.GSD_WORKFLOW_PROJECT_ROOT, explicitCwd);
+		} finally {
+			restore();
+			rmSync(explicitCwd, { recursive: true, force: true });
+		}
+	});
+
+	test("resolveClaudeCodeCwd falls back to process cwd when no stream cwd is provided", () => {
+		assert.equal(resolveClaudeCodeCwd(), process.cwd());
+		assert.equal(resolveClaudeCodeCwd({ cwd: "   " }), process.cwd());
+	});
+
+	test("resolveClaudeCodeCwd returns stream cwd when provided", () => {
+		assert.equal(resolveClaudeCodeCwd({ cwd: "/tmp/current-session" }), "/tmp/current-session");
+	});
+
 	test("buildSdkOptions enables betas for sonnet models", () => {
 		const sonnetOpts = buildSdkOptions("claude-sonnet-4-20250514", "test");
 		assert.ok(
@@ -1212,6 +1255,12 @@ describe("stream-adapter — MCP elicitation bridge", () => {
 // ---------------------------------------------------------------------------
 
 describe("stream-adapter — abort classification (F2)", () => {
+	test("recognizes Claude Code SDK abort exceptions", () => {
+		assert.equal(isClaudeCodeAbortErrorMessage("Claude Code process aborted by user"), true);
+		assert.equal(isClaudeCodeAbortErrorMessage("Request aborted by user"), true);
+		assert.equal(isClaudeCodeAbortErrorMessage("rate limit exceeded"), false);
+	});
+
 	test("makeAbortedMessage sets stopReason to 'aborted', not 'error'", () => {
 		const message = makeAbortedMessage("claude-sonnet-4-6", "");
 		assert.equal(message.stopReason, "aborted");
@@ -1229,6 +1278,24 @@ describe("stream-adapter — abort classification (F2)", () => {
 		assert.notEqual(aborted.stopReason, exhausted.stopReason);
 		assert.equal(exhausted.errorMessage, "stream_exhausted_without_result");
 	});
+
+	test("abort catch preserves SDK diagnostic text instead of partial output", () => {
+		const text = resolveClaudeCodeAbortedMessageText(
+			"Request aborted by user\nAPI Error: 529 overloaded",
+			"partial mid-stream text",
+		);
+
+		assert.equal(text, "Request aborted by user\nAPI Error: 529 overloaded");
+	});
+
+	test("abort catch falls back to partial output for bare abort markers", () => {
+		const text = resolveClaudeCodeAbortedMessageText(
+			"Request aborted by user",
+			"partial mid-stream text",
+		);
+
+		assert.equal(text, "partial mid-stream text");
+	});
 });
 
 // ---------------------------------------------------------------------------

package/src/resources/extensions/github-sync/sync.ts

@@ -122,6 +122,13 @@ export async function runGitHubSync(
   }
 }
 
+export function shouldCreateSlicePrForSyncEvent(
+  unitType: string,
+  config: Pick<GitHubSyncConfig, "slice_prs">,
+): boolean {
+  return unitType === "complete-slice" && config.slice_prs !== false;
+}
+
 // ─── Per-Event Sync Functions ───────────────────────────────────────────────
 
 async function syncMilestonePlan(
@@ -406,7 +413,7 @@ async function syncSliceComplete(
     sliceRecord = getSliceRecord(mapping, mid, sid);
   }
   if (!sliceRecord || sliceRecord.state === "closed") return;
-  if (!sliceRecord.prNumber && config.slice_prs !== false) {
+  if (!sliceRecord.prNumber && shouldCreateSlicePrForSyncEvent("complete-slice", config)) {
     await ensureSlicePullRequest(basePath, mapping, mid, sid);
     sliceRecord = getSliceRecord(mapping, mid, sid);
     if (!sliceRecord || !sliceRecord.prNumber) return;

package/src/resources/extensions/github-sync/tests/sync-source.test.ts

@@ -1,26 +1,14 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-const source = readFileSync(join(import.meta.dirname, "..", "sync.ts"), "utf8");
+import { shouldCreateSlicePrForSyncEvent } from "../sync.ts";
 
 test("slice plan sync records issues without creating a draft PR", () => {
-	const planStart = source.indexOf("async function syncSlicePlan");
-	const prHelperStart = source.indexOf("async function ensureSlicePullRequest");
-	assert.ok(planStart >= 0 && prHelperStart > planStart, "slice plan and PR helper functions are present");
-
-	const planBody = source.slice(planStart, prHelperStart);
-	assert.match(planBody, /prNumber:\s*0/);
-	assert.doesNotMatch(planBody, /ghCreatePR\(/);
-	assert.doesNotMatch(planBody, /ghPushBranch\(/);
+	assert.equal(shouldCreateSlicePrForSyncEvent("plan-slice", { slice_prs: true }), false);
+	assert.equal(shouldCreateSlicePrForSyncEvent("research-slice", { slice_prs: true }), false);
 });
 
 test("slice completion creates the PR only after slice work is complete", () => {
-	const completeStart = source.indexOf("async function syncSliceComplete");
-	const milestoneStart = source.indexOf("async function syncMilestoneComplete");
-	assert.ok(completeStart >= 0 && milestoneStart > completeStart, "slice complete function is present");
-
-	const completeBody = source.slice(completeStart, milestoneStart);
-	assert.match(completeBody, /ensureSlicePullRequest\(basePath, mapping, mid, sid\)/);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", { slice_prs: true }), true);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", {}), true);
+	assert.equal(shouldCreateSlicePrForSyncEvent("complete-slice", { slice_prs: false }), false);
 });

package/src/resources/extensions/gsd/auto/contracts.ts

@@ -1,3 +1,6 @@
+// Project/App: GSD-2
+// File Purpose: Auto Orchestration module interfaces and ADR-015 invariant adapter contracts.
+
 import type { GSDState } from "../types.js";
 
 export interface AutoSessionContext {
@@ -30,7 +33,7 @@ export interface AutoOrchestrationModule {
 }
 
 export interface DispatchAdapter {
-  decideNextUnit(): Promise<{
+  decideNextUnit(input: { stateSnapshot: GSDState }): Promise<{
     unitType: string;
     unitId: string;
     reason: string;
@@ -49,8 +52,20 @@ export interface RecoveryAdapter {
   }>;
 }
 
+export type InvariantAdapterResult =
+  | { ok: true; reason?: string; stateSnapshot?: GSDState }
+  | { ok: false; reason: string; stateSnapshot?: GSDState };
+
+export interface StateReconciliationAdapter {
+  reconcileBeforeDispatch(): Promise<InvariantAdapterResult & { stateSnapshot?: GSDState }>;
+}
+
+export interface ToolContractAdapter {
+  compileUnitToolContract(unitType: string, unitId: string): Promise<InvariantAdapterResult>;
+}
+
 export interface WorktreeAdapter {
-  prepareForUnit(unitType: string, unitId: string): Promise<void>;
+  prepareForUnit(unitType: string, unitId: string): Promise<InvariantAdapterResult>;
   syncAfterUnit(unitType: string, unitId: string): Promise<void>;
   cleanupOnStop(reason: string): Promise<void>;
 }
@@ -78,7 +93,9 @@ export interface NotificationAdapter {
 }
 
 export interface AutoOrchestratorDeps {
+  stateReconciliation: StateReconciliationAdapter;
   dispatch: DispatchAdapter;
+  toolContract: ToolContractAdapter;
   recovery: RecoveryAdapter;
   worktree: WorktreeAdapter;
   health: HealthAdapter;

package/src/resources/extensions/gsd/auto/loop-deps.ts

@@ -18,12 +18,13 @@ import type {
   VerificationResult,
 } from "../auto-verification.js";
 import type { DispatchAction, DispatchContext } from "../auto-dispatch.js";
-import type { WorktreeResolver } from "../worktree-resolver.js";
+import type { WorktreeLifecycle } from "../worktree-lifecycle.js";
+import type { WorktreeStateProjection } from "../worktree-state-projection.js";
 import type { CmuxLogLevel } from "../../shared/cmux-events.js";
 import type { JournalEntry } from "../journal.js";
 import type { MergeReconcileResult } from "../auto-recovery.js";
 import type { UokTurnObserver } from "../uok/contracts.js";
-import type { PreflightResult } from "../clean-root-preflight.js";
+import type { PostflightResult, PreflightResult } from "../clean-root-preflight.js";
 
 type PauseAutoFn = (
   ctx?: ExtensionContext,
@@ -74,12 +75,9 @@ export interface LoopDeps {
     basePath: string,
   ) => Promise<{ proceed: boolean; reason?: string; fixesApplied: string[] }>;
 
-  // Worktree sync
-  syncProjectRootToWorktree: (
-    originalBase: string,
-    basePath: string,
-    milestoneId: string | null,
-  ) => void;
+  // Worktree state projection (ADR-016 — single Module Interface for all
+  // direction-typed projection verbs)
+  worktreeProjection: WorktreeStateProjection;
 
   // Resource version guard
   checkResourcesStale: (version: string | null) => string | null;
@@ -139,8 +137,9 @@ export interface LoopDeps {
   postflightPopStash: (
     basePath: string,
     milestoneId: string,
+    stashMarker: string | undefined,
     notify: (message: string, level: "info" | "warning" | "error") => void,
-  ) => void;
+  ) => PostflightResult;
 
   // Budget/context/secrets
   getLedger: () => unknown;
@@ -268,8 +267,9 @@ export interface LoopDeps {
   // Git
   GitServiceImpl: new (basePath: string, gitConfig: unknown) => unknown;
 
-  // WorktreeResolver
-  resolver: WorktreeResolver;
+  // Worktree Lifecycle Module (ADR-016 — single Module Interface for the
+  // milestone create/enter/exit/merge verbs)
+  lifecycle: WorktreeLifecycle;
 
   // Post-unit processing
   postUnitPreVerification: (

package/src/resources/extensions/gsd/auto/loop.ts

@@ -38,7 +38,7 @@ import {
   getRecentForUnit as getRecentDispatchesForUnit,
   getRecentUnitKeysForProjectRoot,
 } from "../db/unit-dispatches.js";
-import { refreshMilestoneLease } from "../db/milestone-leases.js";
+import { claimMilestoneLease, refreshMilestoneLease } from "../db/milestone-leases.js";
 import { heartbeatAutoWorker } from "../db/auto-workers.js";
 import { getRuntimeKv, setRuntimeKv } from "../db/runtime-kv.js";
 import { resolveUokFlags } from "../uok/flags.js";
@@ -68,7 +68,9 @@ import {
   settleDispatchCompleted,
   settleDispatchFailed,
 } from "./workflow-dispatch-ledger.js";
-import { openDispatchClaim } from "./workflow-dispatch-claim.js";
+import { emitOpenUnitEndForUnit } from "../crash-recovery.js";
+import { writeUnitRuntimeRecord } from "../unit-runtime.js";
+import { ensureDispatchLease, openDispatchClaim } from "./workflow-dispatch-claim.js";
 import { completeWorkflowIteration } from "./workflow-iteration-completion.js";
 import { createWorkflowJournalReporter } from "./workflow-journal-reporter.js";
 import { createWorkflowPhaseReporter } from "./workflow-phase-reporter.js";
@@ -163,6 +165,29 @@ function logDispatchClaimFailed(err: unknown): void {
   });
 }
 
+function logDispatchLeaseRecovered(details: {
+  milestoneId: string;
+  workerId: string;
+  token: number;
+  recovered: boolean;
+}): void {
+  debugLog("autoLoop", {
+    phase: details.recovered ? "dispatch-lease-recovered" : "dispatch-lease-acquired",
+    ...details,
+  });
+}
+
+function logDispatchLeaseRecoveryFailed(details: {
+  milestoneId?: string;
+  workerId?: string;
+  reason: string;
+}): void {
+  debugLog("autoLoop", {
+    phase: "dispatch-lease-recovery-failed",
+    ...details,
+  });
+}
+
 function logCustomVerifyRetryLoadFailure(err: unknown): void {
   debugLog("autoLoop", {
     phase: "load-custom-verify-retries-failed",
@@ -201,6 +226,36 @@ async function enforceMinRequestInterval(s: AutoSession, prefs: IterationContext
   }
 }
 
+function closeOutCrashedUnit(s: AutoSession, iterData: IterationData, err: unknown): void {
+  const summary = formatDispatchExceptionSummary({ error: err });
+  try {
+    emitOpenUnitEndForUnit(
+      s.basePath,
+      iterData.unitType,
+      iterData.unitId,
+      "cancelled",
+      {
+        message: summary,
+        category: "unit-exception",
+        isTransient: false,
+      },
+    );
+    writeUnitRuntimeRecord(
+      s.basePath,
+      iterData.unitType,
+      iterData.unitId,
+      s.currentUnit?.startedAt ?? Date.now(),
+      {
+        phase: "crashed",
+        lastProgressAt: Date.now(),
+        lastProgressKind: "unit-exception",
+      },
+    );
+  } catch (closeoutErr) {
+    logWarning("dispatch", `unit crash closeout failed: ${closeoutErr instanceof Error ? closeoutErr.message : String(closeoutErr)}`);
+  }
+}
+
 /**
  * Main auto-mode execution loop. Iterates: derive → dispatch → guards →
  * runUnit → finalize → repeat. Exits when s.active becomes false or a
@@ -242,6 +297,10 @@ export async function autoLoop(
         phase: "heartbeat-failed",
         error: err instanceof Error ? err.message : String(err),
       }),
+      logLeaseRefreshMiss: details => debugLog("autoLoop", {
+        phase: "lease-refresh-missed",
+        ...details,
+      }),
     });
 
     // ── Journal: per-iteration flow grouping ──
@@ -493,14 +552,23 @@ export async function autoLoop(
 
         // ── Unit execution (shared with dev path) ──
         await enforceMinRequestInterval(s, prefs);
-        const unitPhaseResult = await runUnitPhaseViaContract(
-          dispatchContract,
-          ic,
-          iterData,
-          loopState,
-          undefined,
-          unitDispatchDeps,
-        );
+        let unitPhaseResult: Awaited<ReturnType<typeof runUnitPhaseViaContract>>;
+        try {
+          unitPhaseResult = await runUnitPhaseViaContract(
+            dispatchContract,
+            ic,
+            iterData,
+            loopState,
+            undefined,
+            unitDispatchDeps,
+          );
+        } catch (err) {
+          if (err instanceof ModelPolicyDispatchBlockedError) {
+            throw err;
+          }
+          closeOutCrashedUnit(s, iterData, err);
+          throw err;
+        }
         if (unitPhaseResult.action === "next") {
           const requestTimestamp = resolveUnitRequestTimestamp(unitPhaseResult.data);
           if (requestTimestamp !== undefined) s.lastRequestTimestamp = requestTimestamp;
@@ -662,25 +730,74 @@ export async function autoLoop(
 
       // Phase B: claim a unit_dispatches row before invoking the unit. The
       // partial unique index idx_unit_dispatches_active_per_unit prevents
-      // a second worker from claiming the same unit concurrently. Returns
-      // null when DB unavailable, no worker registered, or no active lease
-      // — those degraded paths fall through to the existing single-worker
-      // semantics with no ledger entry, preserving back-compat.
-      const dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+      // a second worker from claiming the same unit concurrently. When this
+      // process has a worker identity, make the milestone lease explicit before
+      // claiming so a step-mode handoff cannot leave us running with a stale
+      // in-memory token and no backing lease row.
+      const leaseBeforeClaim = ensureDispatchLease(s, iterData.mid, {
+        claimMilestoneLease,
+        logLeaseRecovered: logDispatchLeaseRecovered,
+        logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+      });
+      if (leaseBeforeClaim.kind === "blocked" || leaseBeforeClaim.kind === "failed") {
+        const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} before dispatching ${iterData.unitType} ${iterData.unitId}: ${leaseBeforeClaim.reason}`;
+        ctx.ui.notify(msg, "error");
+        finishTurn("stopped", "execution", msg);
+        await deps.stopAuto(ctx, pi, msg);
+        break;
+      }
+
+      let dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
         getRecentDispatchesForUnit,
         recordDispatchClaim,
         markDispatchRunning,
         logClaimRejected: logDispatchClaimRejected,
         logClaimFailed: logDispatchClaimFailed,
       });
-      const dispatchDecision = decideDispatchClaim(
+      let dispatchDecision = decideDispatchClaim(
         dispatchClaim.kind === "opened"
           ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
           : dispatchClaim.kind === "skip"
             ? { kind: "skip", reason: dispatchClaim.reason }
             : { kind: "degraded" },
       );
+      if (dispatchDecision.action === "skip" && dispatchDecision.reason === "stale-lease") {
+        const leaseRecovery = ensureDispatchLease(s, iterData.mid, {
+          claimMilestoneLease,
+          logLeaseRecovered: logDispatchLeaseRecovered,
+          logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+        }, { forceReclaim: true });
+        if (leaseRecovery.kind === "ready") {
+          dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+            getRecentDispatchesForUnit,
+            recordDispatchClaim,
+            markDispatchRunning,
+            logClaimRejected: logDispatchClaimRejected,
+            logClaimFailed: logDispatchClaimFailed,
+          });
+          dispatchDecision = decideDispatchClaim(
+            dispatchClaim.kind === "opened"
+              ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
+              : dispatchClaim.kind === "skip"
+                ? { kind: "skip", reason: dispatchClaim.reason }
+                : { kind: "degraded" },
+          );
+        } else {
+          const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}: ${leaseRecovery.reason}`;
+          ctx.ui.notify(msg, "error");
+          finishTurn("stopped", "execution", msg);
+          await deps.stopAuto(ctx, pi, msg);
+          break;
+        }
+      }
       if (dispatchDecision.action === "skip") {
+        if (dispatchDecision.reason === "stale-lease") {
+          const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}; dispatch claim still failed after recovery.`;
+          ctx.ui.notify(msg, "error");
+          finishTurn("stopped", "execution", msg);
+          await deps.stopAuto(ctx, pi, msg);
+          break;
+        }
         finishTurn("skipped", "execution", dispatchDecision.reason);
         continue;
       }
@@ -700,6 +817,7 @@ export async function autoLoop(
         if (err instanceof ModelPolicyDispatchBlockedError) {
           throw err;
         }
+        closeOutCrashedUnit(s, iterData, err);
         dispatchSettled = settleDispatchFailed(
           dispatchId,
           formatDispatchExceptionSummary({ error: err }),

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -1,3 +1,6 @@
+// Project/App: GSD-2
+// File Purpose: Auto Orchestration module implementation and ADR-015 invariant pipeline owner.
+
 import type { AutoAdvanceResult, AutoOrchestrationModule, AutoOrchestratorDeps, AutoSessionContext, AutoStatus } from "./contracts.js";
 
 function now(): number {
@@ -36,9 +39,21 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return blocked;
       }
 
-      const decision = await this.deps.dispatch.decideNextUnit();
+      const reconciliation = await this.deps.stateReconciliation.reconcileBeforeDispatch();
+      if (!reconciliation.ok || !reconciliation.stateSnapshot) {
+        const blocked: AutoAdvanceResult = {
+          kind: "blocked",
+          reason: reconciliation.reason,
+          stateSnapshot: reconciliation.stateSnapshot,
+        };
+        await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
+        await this.deps.health.postAdvanceRecord(blocked);
+        return blocked;
+      }
+
+      const decision = await this.deps.dispatch.decideNextUnit({ stateSnapshot: reconciliation.stateSnapshot });
       if (!decision) {
-        const stopped: AutoAdvanceResult = { kind: "stopped", reason: "no remaining units" };
+        const stopped: AutoAdvanceResult = { kind: "stopped", reason: "no remaining units", stateSnapshot: reconciliation.stateSnapshot };
         this.status.phase = "stopped";
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
@@ -61,6 +76,40 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return blocked;
       }
 
+      const contract = await this.deps.toolContract.compileUnitToolContract(decision.unitType, decision.unitId);
+      if (!contract.ok) {
+        const blocked: AutoAdvanceResult = {
+          kind: "blocked",
+          reason: contract.reason,
+          stateSnapshot: reconciliation.stateSnapshot,
+        };
+        await this.deps.runtime.journalTransition({
+          name: "advance-blocked",
+          reason: blocked.reason,
+          unitType: decision.unitType,
+          unitId: decision.unitId,
+        });
+        await this.deps.health.postAdvanceRecord(blocked);
+        return blocked;
+      }
+
+      const worktree = await this.deps.worktree.prepareForUnit(decision.unitType, decision.unitId);
+      if (!worktree.ok) {
+        const blocked: AutoAdvanceResult = {
+          kind: "blocked",
+          reason: worktree.reason,
+          stateSnapshot: reconciliation.stateSnapshot,
+        };
+        await this.deps.runtime.journalTransition({
+          name: "advance-blocked",
+          reason: blocked.reason,
+          unitType: decision.unitType,
+          unitId: decision.unitId,
+        });
+        await this.deps.health.postAdvanceRecord(blocked);
+        return blocked;
+      }
+
       this.status.activeUnit = { unitType: decision.unitType, unitId: decision.unitId };
       this.status.phase = "running";
       this.lastAdvanceKey = nextKey;
@@ -72,10 +121,9 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         unitType: decision.unitType,
         unitId: decision.unitId,
       });
-      await this.deps.worktree.prepareForUnit(decision.unitType, decision.unitId);
       await this.deps.worktree.syncAfterUnit(decision.unitType, decision.unitId);
 
-      const advanced: AutoAdvanceResult = { kind: "advanced" };
+      const advanced: AutoAdvanceResult = { kind: "advanced", stateSnapshot: reconciliation.stateSnapshot };
       await this.deps.health.postAdvanceRecord(advanced);
       return advanced;
     } catch (error) {