gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.d4fc28e6b

package/README.md

@@ -259,6 +259,7 @@ Full documentation is in the [`docs/`](./docs/) directory:
 
 - **[Architecture](./docs/dev/architecture.md)** — system design and dispatch pipeline
 - **[CI/CD Pipeline](./docs/dev/ci-cd-pipeline.md)** — three-stage promotion pipeline (Dev → Test → Prod)
+- **[E2E Testing](./tests/e2e/README.md)** — real-process CLI/runtime coverage and CI runner expectations
 - **[Pipeline Simplification (ADR-003)](./docs/dev/ADR-003-pipeline-simplification.md)** — merged research into planning, mechanical completion
 - **[VS Code Extension](./vscode-extension/README.md)** — chat participant, sidebar dashboard, RPC integration
 
@@ -361,7 +362,7 @@ The database is authoritative for milestones, slices, tasks, requirements, decis
 
 2. **Context pre-loading** — The dispatch prompt includes inlined task plans, slice plans, prior task summaries, dependency summaries, roadmap excerpts, and decisions register. The LLM starts with everything it needs instead of spending tool calls reading files.
 
-3. **Context Mode** — Context Mode is enabled by default and gives every auto-mode unit guidance for preserving context. Agents are steered toward `gsd_exec` for noisy scans, builds, tests, and diagnostics; full stdout/stderr is saved under `.gsd/exec/` while only a short digest enters the conversation. `gsd_exec_search` lets agents reuse prior runs instead of repeating expensive checks, and `gsd_resume` reads `.gsd/last-snapshot.md` after compaction or resume. Opt out with `context_mode.enabled: false`; tune sandbox timeout/output caps with `context_mode.exec_timeout_ms`, `context_mode.exec_stdout_cap_bytes`, and `context_mode.exec_digest_chars`.
+3. **Context Mode** — Context Mode is enabled by default and gives eligible auto-mode units guidance for preserving context. Agents are steered toward `gsd_exec` for noisy scans, builds, tests, and diagnostics; capped stdout/stderr and metadata are saved under `.gsd/exec/` while only a short digest enters the conversation. `gsd_exec_search` lets agents reuse prior runs instead of repeating expensive checks, and `gsd_resume` reads a prior compaction snapshot from `.gsd/last-snapshot.md` when one exists. Opt out with `context_mode.enabled: false` to disable Context Mode guidance, snapshot injection, `gsd_exec`, `gsd_exec_search`, and `gsd_resume`; tune sandbox timeout/output caps and environment forwarding with `context_mode.exec_timeout_ms`, `context_mode.exec_stdout_cap_bytes`, `context_mode.exec_digest_chars`, and `context_mode.exec_env_allowlist`.
 
 4. **Git isolation** — When `git.isolation` is set to `worktree` or `branch`, each milestone runs on its own `milestone/<MID>` branch (in a worktree or in-place). All slice work commits sequentially — no branch switching, no merge conflicts. When the milestone completes, it's squash-merged to main as one clean commit. The default is `none` (work on the current branch), configurable via preferences. If `worktree` is configured in a repo with no committed `HEAD`, GSD temporarily behaves as `none` until the first commit exists because git worktrees need a committed start point.
 
@@ -659,10 +660,11 @@ auto_report: true
 | `unique_milestone_ids`            | Uses unique milestone names to avoid clashes when working in teams of people                          |
 | `git.isolation`                   | `none` (default), `worktree`, or `branch` — enable worktree or branch isolation for milestone work. `worktree` requires a committed `HEAD`; zero-commit repos temporarily run as `none`    |
 | `git.manage_gitignore`            | Set `false` to prevent GSD from modifying `.gitignore`                                                |
-| `context_mode.enabled`            | Context Mode is default-on; set `false` to disable `gsd_exec`, exec history guidance, and resume snapshots |
+| `context_mode.enabled`            | Context Mode is default-on; set `false` to disable prompt guidance, snapshot injection, `gsd_exec`, `gsd_exec_search`, and `gsd_resume` |
 | `context_mode.exec_timeout_ms`    | Timeout for sandboxed `gsd_exec` runs (default: 30000)                                                |
 | `context_mode.exec_stdout_cap_bytes` | Persisted stdout cap for `gsd_exec` output (default: 1048576)                                      |
 | `context_mode.exec_digest_chars`  | Trailing stdout characters returned to the agent context (default: 300)                              |
+| `context_mode.exec_env_allowlist` | Environment variables forwarded to sandboxed `gsd_exec` runs in addition to `PATH` and `HOME`        |
 | `verification_commands`           | Array of shell commands to run after task execution (e.g., `["npm run lint", "npm run test"]`)        |
 | `verification_auto_fix`           | Auto-retry on verification failures (default: true)                                                   |
 | `verification_max_retries`        | Max retries for verification failures (default: 2)                                                    |

package/dist/cli.js

@@ -760,25 +760,6 @@ if (!process.stdin.isTTY || !process.stdout.isTTY) {
             : 'stdout is';
     printNonTtyErrorAndExit(missing, true);
 }
-// Welcome screen — shown on every fresh interactive session before TUI takes over.
-// Skip when the first-run banner was already printed in loader.ts (prevents double banner).
-if (!process.env.GSD_FIRST_RUN_BANNER) {
-    const { printWelcomeScreen } = await import('./welcome-screen.js');
-    let remoteChannel;
-    try {
-        const { resolveRemoteConfig } = await import('./resources/extensions/remote-questions/config.js');
-        const rc = resolveRemoteConfig();
-        if (rc)
-            remoteChannel = rc.channel;
-    }
-    catch { /* non-fatal */ }
-    printWelcomeScreen({
-        version: process.env.GSD_VERSION || '0.0.0',
-        modelName: settingsManager.getDefaultModel() || undefined,
-        provider: settingsManager.getDefaultProvider() || undefined,
-        remoteChannel,
-    });
-}
 const interactiveMode = new InteractiveMode(session);
 markStartup('InteractiveMode');
 printStartupTimings();

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-4cdd0ed39f5663d1
+83a1a81197451245

package/dist/resources/GSD-WORKFLOW.md

@@ -28,7 +28,7 @@ Then do the thing `STATE.md` says to do next.
 ## The Hierarchy
 
 ```
-Milestone  →  a shippable version (4-10 slices)
+Milestone  →  a shippable version (1-10 slices, sized to the work)
   Slice    →  one demoable vertical capability (1-7 tasks)
     Task   →  one context-window-sized unit of work (fits in one session)
 ```
@@ -331,7 +331,7 @@ The **Don't Hand-Roll** and **Common Pitfalls** sections prevent the most expens
 
 **For a milestone (roadmap):**
 1. Read `M###-CONTEXT.md`, `M###-RESEARCH.md`, and `.gsd/DECISIONS.md` if they exist.
-2. Decompose the vision into 4-10 demoable vertical slices.
+2. Decompose the vision into 1-10 demoable vertical slices. Prefer one slice for tiny, single-file, or static work unless the request clearly spans independent capabilities.
 3. Order by risk (high-risk first to validate feasibility early).
 4. Write `M###-ROADMAP.md` with checkboxes, risk levels, dependencies, demo sentences.
 5. **Write the boundary map** — for each slice, specify what it produces (functions, types, interfaces, endpoints) and what it consumes from upstream slices. This forces interface thinking before implementation and enables deterministic verification that slices actually connect.

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -261,6 +261,26 @@ function makeErrorMessage(model, errorMsg) {
         timestamp: Date.now(),
     };
 }
+export function isClaudeCodeAbortErrorMessage(message) {
+    if (!message)
+        return false;
+    return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
+}
+function isBareClaudeCodeAbortErrorMessage(message) {
+    if (!message)
+        return false;
+    const normalized = message.trim().replace(/\s+/g, " ").toLowerCase();
+    return normalized === "claude code process aborted by user"
+        || normalized === "request aborted by user"
+        || normalized === "process aborted by user";
+}
+export function resolveClaudeCodeAbortedMessageText(errorMsg, lastTextContent) {
+    const trimmedError = errorMsg.trim();
+    if (trimmedError && !isBareClaudeCodeAbortErrorMessage(trimmedError)) {
+        return trimmedError;
+    }
+    return lastTextContent;
+}
 /**
  * Generator exhaustion without a terminal result means the SDK stream was
  * interrupted mid-turn. Surface it as an error so downstream recovery logic
@@ -1512,6 +1532,15 @@ async function pumpSdkMessages(model, context, options, stream) {
     }
     catch (err) {
         const errorMsg = err instanceof Error ? err.message : String(err);
+        if (options?.signal?.aborted || isClaudeCodeAbortErrorMessage(errorMsg)) {
+            const abortedText = resolveClaudeCodeAbortedMessageText(errorMsg, lastTextContent);
+            stream.push({
+                type: "error",
+                reason: "aborted",
+                error: makeAbortedMessage(modelId, abortedText),
+            });
+            return;
+        }
         stream.push({
             type: "error",
             reason: "error",

package/dist/resources/extensions/github-sync/templates.js

@@ -8,6 +8,37 @@
  * for the `gh` CLI body parameters.
  */
 import { buildPrEvidence } from "../gsd/pr-evidence.js";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+/**
+ * Wrap a string in a CommonMark inline-code span, escaping any embedded
+ * backticks by selecting a fence longer than the longest backtick run inside
+ * the input. If the input begins or ends with a backtick, pad with a single
+ * space inside the fence (CommonMark requirement).
+ *
+ * Empty input returns an empty string (no fence) — there is nothing to render
+ * as code, and emitting an empty pair of backticks would produce literal
+ * backticks in GitHub-flavored markdown.
+ */
+export function inlineCode(s) {
+    if (s.length === 0)
+        return "";
+    let longestRun = 0;
+    let currentRun = 0;
+    for (const ch of s) {
+        if (ch === "`") {
+            currentRun++;
+            if (currentRun > longestRun)
+                longestRun = currentRun;
+        }
+        else {
+            currentRun = 0;
+        }
+    }
+    const fence = "`".repeat(longestRun + 1);
+    const needsPad = s.startsWith("`") || s.endsWith("`");
+    const pad = needsPad ? " " : "";
+    return `${fence}${pad}${s}${pad}${fence}`;
+}
 export function formatMilestoneIssueBody(data) {
     const lines = [];
     lines.push(`# ${data.id}: ${data.title}`);
@@ -78,7 +109,7 @@ export function formatTaskIssueBody(data) {
     if (data.files?.length) {
         lines.push("### Files");
         for (const file of data.files) {
-            lines.push(`- \`${file}\``);
+            lines.push(`- ${inlineCode(file)}`);
         }
         lines.push("");
     }
@@ -132,15 +163,14 @@ export function formatSwarmLanePRBody(data) {
     const summaries = [
         [
             "### Swarm lane",
-            `**Lane:** \`${laneLabel}\``,
-            `**Branch:** \`${data.lane.branch}\``,
+            `**Lane:** ${inlineCode(laneLabel)}`,
+            `**Branch:** ${inlineCode(data.lane.branch)}`,
             data.lane.owner ? `**Owner:** ${data.lane.owner}` : "",
-            data.lane.latestCommit ? `**Latest commit:** \`${data.lane.latestCommit}\`` : "",
+            data.lane.latestCommit ? `**Latest commit:** ${inlineCode(data.lane.latestCommit)}` : "",
         ].filter(Boolean).join("\n"),
         `### Impact area\n${data.impactArea}`,
         `### Changed contracts\n${checkedList(data.lane.changedContracts, "No shared contracts changed").join("\n")}`,
         `### Transition risks\n${checkedList(data.transitionRisks, "No transition risks identified").join("\n")}`,
-        data.lane.blockers?.length ? `### Blockers\n${data.lane.blockers.map((blocker) => `- ${blocker}`).join("\n")}` : "",
     ].filter(Boolean);
     return buildPrEvidence({
         milestoneId: laneLabel,
@@ -150,6 +180,7 @@ export function formatSwarmLanePRBody(data) {
         changeType: "refactor",
         linkedIssue: data.linkedIssue ? `Closes #${data.linkedIssue}` : undefined,
         summaries,
+        blockers: data.lane.blockers ?? [],
         testsRun: data.lane.testEvidence,
         rollbackNotes: data.rollbackPlan,
         how: "Generated by GSD GitHub Sync swarm routines from lane evidence.",
@@ -159,7 +190,7 @@ export function formatSwarmReleaseChecklistBody(data) {
     const lines = [];
     lines.push(`# UOK Swarm Release Checklist`);
     lines.push("");
-    lines.push(`**Integration branch:** \`${data.integrationBranch}\``);
+    lines.push(`**Integration branch:** ${inlineCode(data.integrationBranch)}`);
     lines.push("");
     lines.push("## Lane summary");
     lines.push("");
@@ -167,9 +198,9 @@ export function formatSwarmReleaseChecklistBody(data) {
     lines.push("|------|--------|-------|--------|--------|");
     for (const lane of data.lanes) {
         const owner = lane.owner ?? "";
-        const commit = lane.latestCommit ? `\`${lane.latestCommit}\`` : "";
+        const commit = lane.latestCommit ? inlineCode(lane.latestCommit) : "";
         const status = lane.blockers?.length ? "blocked" : "ready";
-        lines.push(`| \`${SWARM_LANE_LABELS[lane.id]}\` | \`${lane.branch}\` | ${owner} | ${commit} | ${status} |`);
+        lines.push(`| ${inlineCode(SWARM_LANE_LABELS[lane.id])} | ${inlineCode(lane.branch)} | ${owner} | ${commit} | ${status} |`);
     }
     lines.push("");
     lines.push("## Required evidence");

package/dist/resources/extensions/gsd/auto/loop.js

@@ -16,7 +16,7 @@ import { ModelPolicyDispatchBlockedError } from "../auto-model-selection.js";
 import { resolveEngine } from "../engine-resolver.js";
 import { logWarning } from "../workflow-logger.js";
 import { recordDispatchClaim, markRunning as markDispatchRunning, markCompleted as markDispatchCompleted, markFailed as markDispatchFailed, getRecentForUnit as getRecentDispatchesForUnit, getRecentUnitKeysForProjectRoot, } from "../db/unit-dispatches.js";
-import { refreshMilestoneLease } from "../db/milestone-leases.js";
+import { claimMilestoneLease, refreshMilestoneLease } from "../db/milestone-leases.js";
 import { heartbeatAutoWorker } from "../db/auto-workers.js";
 import { getRuntimeKv, setRuntimeKv } from "../db/runtime-kv.js";
 import { resolveUokFlags } from "../uok/flags.js";
@@ -25,7 +25,9 @@ import { normalizeRealPath } from "../paths.js";
 import { decideCooldownRecovery, decideDispatchClaim, decideEngineDispatch, decideFinalizeResult, decideInfrastructureError, decideIterationErrorRecovery, decideMemoryPressure, decideModelPolicyBlocked, decideMinRequestInterval, decideWorkflowLoop, formatDispatchExceptionSummary, formatUnhandledDispatchErrorSummary, resolveUnitRequestTimestamp, shouldUseCustomEnginePath, } from "./workflow-kernel.js";
 import { hydrateCustomVerifyRetryCounts, saveCustomVerifyRetryCounts, } from "./custom-verify-retry-store.js";
 import { settleDispatchCompleted, settleDispatchFailed, } from "./workflow-dispatch-ledger.js";
-import { openDispatchClaim } from "./workflow-dispatch-claim.js";
+import { emitOpenUnitEndForUnit } from "../crash-recovery.js";
+import { writeUnitRuntimeRecord } from "../unit-runtime.js";
+import { ensureDispatchLease, openDispatchClaim } from "./workflow-dispatch-claim.js";
 import { completeWorkflowIteration } from "./workflow-iteration-completion.js";
 import { createWorkflowJournalReporter } from "./workflow-journal-reporter.js";
 import { createWorkflowPhaseReporter } from "./workflow-phase-reporter.js";
@@ -103,6 +105,18 @@ function logDispatchClaimFailed(err) {
         error: err instanceof Error ? err.message : String(err),
     });
 }
+function logDispatchLeaseRecovered(details) {
+    debugLog("autoLoop", {
+        phase: details.recovered ? "dispatch-lease-recovered" : "dispatch-lease-acquired",
+        ...details,
+    });
+}
+function logDispatchLeaseRecoveryFailed(details) {
+    debugLog("autoLoop", {
+        phase: "dispatch-lease-recovery-failed",
+        ...details,
+    });
+}
 function logCustomVerifyRetryLoadFailure(err) {
     debugLog("autoLoop", {
         phase: "load-custom-verify-retries-failed",
@@ -133,6 +147,24 @@ async function enforceMinRequestInterval(s, prefs) {
         await new Promise(r => setTimeout(r, decision.waitMs));
     }
 }
+function closeOutCrashedUnit(s, iterData, err) {
+    const summary = formatDispatchExceptionSummary({ error: err });
+    try {
+        emitOpenUnitEndForUnit(s.basePath, iterData.unitType, iterData.unitId, "cancelled", {
+            message: summary,
+            category: "unit-exception",
+            isTransient: false,
+        });
+        writeUnitRuntimeRecord(s.basePath, iterData.unitType, iterData.unitId, s.currentUnit?.startedAt ?? Date.now(), {
+            phase: "crashed",
+            lastProgressAt: Date.now(),
+            lastProgressKind: "unit-exception",
+        });
+    }
+    catch (closeoutErr) {
+        logWarning("dispatch", `unit crash closeout failed: ${closeoutErr instanceof Error ? closeoutErr.message : String(closeoutErr)}`);
+    }
+}
 /**
  * Main auto-mode execution loop. Iterates: derive → dispatch → guards →
  * runUnit → finalize → repeat. Exits when s.active becomes false or a
@@ -166,6 +198,10 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                 phase: "heartbeat-failed",
                 error: err instanceof Error ? err.message : String(err),
             }),
+            logLeaseRefreshMiss: details => debugLog("autoLoop", {
+                phase: "lease-refresh-missed",
+                ...details,
+            }),
         });
         // ── Journal: per-iteration flow grouping ──
         const flowId = randomUUID();
@@ -268,6 +304,19 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             // ── Blanket try/catch: one bad iteration must not kill the session
             const prefs = deps.loadEffectiveGSDPreferences()?.preferences;
             const uokFlags = resolveUokFlags(prefs);
+            // ── Check sidecar queue before deriveState ──
+            // NOTE: Sidecar dequeue MUST run before validateWorkflowSessionLock so a
+            // queued item is popped (and the `sidecar-dequeue` journal event emitted)
+            // even when the session lock invalidates this iteration. Inverting this
+            // order silently drops queued items on lock-loss. Refs #5308.
+            const sidecarItem = await dequeueSidecarItem({
+                queue: s.sidecarQueue,
+                executionGraphEnabled: uokFlags.executionGraph,
+                scheduleQueue: scheduleSidecarQueue,
+                warnSchedulingFailure: message => logWarning("dispatch", `sidecar queue scheduling failed: ${message}`),
+                logDequeue: payload => debugLog("autoLoop", { phase: "sidecar-dequeue", ...payload }),
+                emitDequeue: payload => journalReporter.emit("sidecar-dequeue", payload),
+            });
             const sessionLockOutcome = validateWorkflowSessionLock({
                 active: s.active,
                 iteration,
@@ -287,17 +336,9 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                 },
             });
             if (sessionLockOutcome.action === "stop" && sessionLockOutcome.reason === "session-lock-lost") {
+                finishTurn("stopped", "manual-attention", sessionLockOutcome.reason);
                 break;
             }
-            // ── Check sidecar queue before deriveState ──
-            const sidecarItem = await dequeueSidecarItem({
-                queue: s.sidecarQueue,
-                executionGraphEnabled: uokFlags.executionGraph,
-                scheduleQueue: scheduleSidecarQueue,
-                warnSchedulingFailure: message => logWarning("dispatch", `sidecar queue scheduling failed: ${message}`),
-                logDequeue: payload => debugLog("autoLoop", { phase: "sidecar-dequeue", ...payload }),
-                emitDequeue: payload => journalReporter.emit("sidecar-dequeue", payload),
-            });
             const ic = { ctx, pi, s, deps, prefs, iteration, flowId, nextSeq };
             journalReporter.emit("iteration-start", { iteration });
             let iterData;
@@ -331,6 +372,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     isComplete: engineState.isComplete,
                 });
                 if (engineState.isComplete) {
+                    finishTurn("completed");
                     await deps.stopAuto(ctx, pi, "Workflow complete");
                     break;
                 }
@@ -386,7 +428,17 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                 }
                 // ── Unit execution (shared with dev path) ──
                 await enforceMinRequestInterval(s, prefs);
-                const unitPhaseResult = await runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState, undefined, unitDispatchDeps);
+                let unitPhaseResult;
+                try {
+                    unitPhaseResult = await runUnitPhaseViaContract(dispatchContract, ic, iterData, loopState, undefined, unitDispatchDeps);
+                }
+                catch (err) {
+                    if (err instanceof ModelPolicyDispatchBlockedError) {
+                        throw err;
+                    }
+                    closeOutCrashedUnit(s, iterData, err);
+                    throw err;
+                }
                 if (unitPhaseResult.action === "next") {
                     const requestTimestamp = resolveUnitRequestTimestamp(unitPhaseResult.data);
                     if (requestTimestamp !== undefined)
@@ -545,23 +597,70 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             await enforceMinRequestInterval(s, prefs);
             // Phase B: claim a unit_dispatches row before invoking the unit. The
             // partial unique index idx_unit_dispatches_active_per_unit prevents
-            // a second worker from claiming the same unit concurrently. Returns
-            // null when DB unavailable, no worker registered, or no active lease
-            // — those degraded paths fall through to the existing single-worker
-            // semantics with no ledger entry, preserving back-compat.
-            const dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+            // a second worker from claiming the same unit concurrently. When this
+            // process has a worker identity, make the milestone lease explicit before
+            // claiming so a step-mode handoff cannot leave us running with a stale
+            // in-memory token and no backing lease row.
+            const leaseBeforeClaim = ensureDispatchLease(s, iterData.mid, {
+                claimMilestoneLease,
+                logLeaseRecovered: logDispatchLeaseRecovered,
+                logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+            });
+            if (leaseBeforeClaim.kind === "blocked" || leaseBeforeClaim.kind === "failed") {
+                const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} before dispatching ${iterData.unitType} ${iterData.unitId}: ${leaseBeforeClaim.reason}`;
+                ctx.ui.notify(msg, "error");
+                finishTurn("stopped", "execution", msg);
+                await deps.stopAuto(ctx, pi, msg);
+                break;
+            }
+            let dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
                 getRecentDispatchesForUnit,
                 recordDispatchClaim,
                 markDispatchRunning,
                 logClaimRejected: logDispatchClaimRejected,
                 logClaimFailed: logDispatchClaimFailed,
             });
-            const dispatchDecision = decideDispatchClaim(dispatchClaim.kind === "opened"
+            let dispatchDecision = decideDispatchClaim(dispatchClaim.kind === "opened"
                 ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
                 : dispatchClaim.kind === "skip"
                     ? { kind: "skip", reason: dispatchClaim.reason }
                     : { kind: "degraded" });
+            if (dispatchDecision.action === "skip" && dispatchDecision.reason === "stale-lease") {
+                const leaseRecovery = ensureDispatchLease(s, iterData.mid, {
+                    claimMilestoneLease,
+                    logLeaseRecovered: logDispatchLeaseRecovered,
+                    logLeaseRecoveryFailed: logDispatchLeaseRecoveryFailed,
+                }, { forceReclaim: true });
+                if (leaseRecovery.kind === "ready") {
+                    dispatchClaim = openDispatchClaim(s, flowId, turnId, iterData, {
+                        getRecentDispatchesForUnit,
+                        recordDispatchClaim,
+                        markDispatchRunning,
+                        logClaimRejected: logDispatchClaimRejected,
+                        logClaimFailed: logDispatchClaimFailed,
+                    });
+                    dispatchDecision = decideDispatchClaim(dispatchClaim.kind === "opened"
+                        ? { kind: "opened", dispatchId: dispatchClaim.dispatchId }
+                        : dispatchClaim.kind === "skip"
+                            ? { kind: "skip", reason: dispatchClaim.reason }
+                            : { kind: "degraded" });
+                }
+                else {
+                    const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}: ${leaseRecovery.reason}`;
+                    ctx.ui.notify(msg, "error");
+                    finishTurn("stopped", "execution", msg);
+                    await deps.stopAuto(ctx, pi, msg);
+                    break;
+                }
+            }
             if (dispatchDecision.action === "skip") {
+                if (dispatchDecision.reason === "stale-lease") {
+                    const msg = `Lost milestone lease for ${iterData.mid ?? "unknown"} while claiming ${iterData.unitType} ${iterData.unitId}; dispatch claim still failed after recovery.`;
+                    ctx.ui.notify(msg, "error");
+                    finishTurn("stopped", "execution", msg);
+                    await deps.stopAuto(ctx, pi, msg);
+                    break;
+                }
                 finishTurn("skipped", "execution", dispatchDecision.reason);
                 continue;
             }
@@ -574,6 +673,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                 if (err instanceof ModelPolicyDispatchBlockedError) {
                     throw err;
                 }
+                closeOutCrashedUnit(s, iterData, err);
                 dispatchSettled = settleDispatchFailed(dispatchId, formatDispatchExceptionSummary({ error: err }), {
                     markFailed: markDispatchFailed,
                     logWriteFailure: logDispatchLedgerWriteFailure,
@@ -734,6 +834,7 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                 });
                 if (cooldownDecision.action === "stop") {
                     ctx.ui.notify(cooldownDecision.notifyMessage, "error");
+                    finishTurn("stopped", "timeout", msg);
                     await deps.stopAuto(ctx, pi, cooldownDecision.stopMessage);
                     break;
                 }