gsd-pi 2.80.0-dev.fbe7c8c6f → 2.81.0-dev.3cddbbba2

package/src/resources/extensions/gsd/auto/resolve.ts

@@ -22,6 +22,10 @@ import { bumpTurnGeneration } from "./turn-epoch.js";
 
 let _currentResolve: ((result: UnitResult) => void) | null = null;
 let _sessionSwitchInFlight = false;
+let _pendingSwitchCancellation: { errorContext?: ErrorContext } | null = null;
+let _sessionSwitchAbortGraceUntil = 0;
+
+const DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS = 2_000;
 
 // ─── Setters (needed for cross-module mutation) ─────────────────────────────
 
@@ -33,10 +37,31 @@ export function _setSessionSwitchInFlight(v: boolean): void {
   _sessionSwitchInFlight = v;
 }
 
+export function _markSessionSwitchAbortGraceWindow(durationMs = DEFAULT_SESSION_SWITCH_ABORT_GRACE_MS): void {
+  _sessionSwitchAbortGraceUntil = Math.max(
+    _sessionSwitchAbortGraceUntil,
+    Date.now() + durationMs,
+  );
+}
+
+export function _clearSessionSwitchAbortGraceWindow(): void {
+  _sessionSwitchAbortGraceUntil = 0;
+}
+
+export function isSessionSwitchAbortGraceActive(now = Date.now()): boolean {
+  return now < _sessionSwitchAbortGraceUntil;
+}
+
 export function _clearCurrentResolve(): void {
   _currentResolve = null;
 }
 
+export function _consumePendingSwitchCancellation(): { errorContext?: ErrorContext } | null {
+  const pending = _pendingSwitchCancellation;
+  _pendingSwitchCancellation = null;
+  return pending;
+}
+
 // ─── resolveAgentEnd ─────────────────────────────────────────────────────────
 
 /**
@@ -96,7 +121,7 @@ export function bumpAndResolveSynthetic(reason: string): void {
  * blocks to ensure the autoLoop is never stuck awaiting a promise that
  * will never resolve. Safe to call when no resolver is pending (no-op).
  */
-export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
+export function resolveAgentEndCancelled(errorContext?: ErrorContext): boolean {
   if (_currentResolve) {
     // Cancellation supersedes the in-flight turn the same way timeout
     // recovery does — bump the turn epoch so any lingering writes from the
@@ -107,8 +132,22 @@ export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
     debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
     const r = _currentResolve;
     _currentResolve = null;
+    _pendingSwitchCancellation = null;
     r({ status: "cancelled", ...(errorContext ? { errorContext } : {}) });
+    return true;
   }
+
+  if (_sessionSwitchInFlight) {
+    bumpTurnGeneration(
+      `cancelled-during-switch:${errorContext?.category ?? "unknown"}`,
+    );
+    _pendingSwitchCancellation = errorContext ? { errorContext } : {};
+    debugLog("resolveAgentEndCancelled", { status: "queued-during-switch" });
+    return false;
+  }
+
+  debugLog("resolveAgentEndCancelled", { status: "no-pending-resolve" });
+  return false;
 }
 
 // ─── resetPendingResolve (test helper) ───────────────────────────────────────
@@ -120,6 +159,8 @@ export function resolveAgentEndCancelled(errorContext?: ErrorContext): void {
 export function _resetPendingResolve(): void {
   _currentResolve = null;
   _sessionSwitchInFlight = false;
+  _pendingSwitchCancellation = null;
+  _sessionSwitchAbortGraceUntil = 0;
 }
 
 export function _hasPendingResolveForTest(): boolean {

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -11,7 +11,13 @@ import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
 import type { AutoSession } from "./session.js";
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
 import type { UnitResult } from "./types.js";
-import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import {
+  _clearCurrentResolve,
+  _consumePendingSwitchCancellation,
+  _markSessionSwitchAbortGraceWindow,
+  _setCurrentResolve,
+  _setSessionSwitchInFlight,
+} from "./resolve.js";
 import {
   getCurrentTurnGeneration,
   runWithTurnGeneration,
@@ -20,6 +26,31 @@ import { debugLog } from "../debug-logger.js";
 import { logWarning, logError } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
 import { formatAutoUnitWorkingMessage } from "../working-output-messages.js";
+import { readUnitRuntimeRecord, type AutoUnitRuntimeRecord } from "../unit-runtime.js";
+
+const UNIT_FAILSAFE_BUFFER_MS = 30_000;
+const UNIT_FAILSAFE_RECHECK_MS = 30_000;
+
+export function shouldDeferUnitFailsafeTimeout(
+  runtime: AutoUnitRuntimeRecord | null,
+  opts: {
+    nowMs: number;
+    currentUnitStartedAt?: number;
+    freshProgressMs: number;
+  },
+): boolean {
+  if (!runtime) return false;
+  if (opts.currentUnitStartedAt === undefined) return false;
+  if (runtime.startedAt !== opts.currentUnitStartedAt) return false;
+  if (runtime.lastProgressAt <= 0) return false;
+  const progressAgeMs = opts.nowMs - runtime.lastProgressAt;
+  if (progressAgeMs < 0) return false;
+  if (progressAgeMs > opts.freshProgressMs) return false;
+  if (runtime.phase === "recovered") return true;
+  if (runtime.lastProgressKind.includes("recovery")) return true;
+  if (runtime.recoveryAttempts && runtime.recoveryAttempts > 0) return true;
+  return progressAgeMs >= 0 && progressAgeMs <= opts.freshProgressMs;
+}
 
 // Tracks the latest session-switch attempt so a late timeout settlement from an
 // older runUnit() call cannot clear the guard for a newer one.
@@ -43,45 +74,24 @@ export async function runUnit(
 ): Promise<UnitResult> {
   debugLog("runUnit", { phase: "start", unitType, unitId });
 
-  // Ensure cwd matches basePath BEFORE newSession() captures it. The new
-  // session reads process.cwd() during construction to anchor its tool
-  // runtime and system prompt; if cwd has drifted (async_bash, background
-  // jobs, prior unit cleanup), the session would otherwise be rooted to
-  // the wrong directory. Must be synchronous — no awaits between chdir
-  // and newSession (#1389, #4762 follow-up).
-  try {
-    if (process.cwd() !== s.basePath) {
-      process.chdir(s.basePath);
-    }
-  } catch (e) {
-    const msg = `Failed to chdir to basePath before newSession (basePath: ${s.basePath}): ${String(e)}`;
-    logWarning("engine", msg, { basePath: s.basePath, error: String(e) });
-    return {
-      status: "cancelled",
-      errorContext: {
-        message: msg,
-        category: "session-failed",
-        isTransient: true,
-      },
-    };
-  }
-
   // ── Session creation with timeout ──
   debugLog("runUnit", { phase: "session-create", unitType, unitId });
 
   let sessionResult: { cancelled: boolean };
   let sessionTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
   const mySessionSwitchGeneration = ++sessionSwitchGeneration;
-  // #3731: Cancellation controller for newSession(). When the session-creation
-  // timeout fires, we abort this controller so that the still-in-flight
-  // newSession() discards itself after await this.abort() completes, preventing
-  // it from capturing the (now-root) process.cwd() and rebuilding the tool
-  // runtime with the wrong cwd.
+  // #3731: Cancellation controller for newSession(). When session creation
+  // times out, abort before a late session switch can rebuild the tool runtime
+  // against a stale workspace root.
   const sessionAbortController = new AbortController();
   _setSessionSwitchInFlight(true);
   try {
-    const sessionPromise = s.cmdCtx!.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
+    const sessionPromise = s.cmdCtx!.newSession({
+      abortSignal: sessionAbortController.signal,
+      workspaceRoot: s.basePath,
+    }).finally(() => {
       if (sessionSwitchGeneration === mySessionSwitchGeneration) {
+        _markSessionSwitchAbortGraceWindow();
         _setSessionSwitchInFlight(false);
       }
     });
@@ -97,6 +107,7 @@ export async function runUnit(
     sessionResult = await Promise.race([sessionPromise, timeoutPromise]);
   } catch (sessionErr) {
     if (sessionTimeoutHandle) clearTimeout(sessionTimeoutHandle);
+    _consumePendingSwitchCancellation();
     const msg =
       sessionErr instanceof Error ? sessionErr.message : String(sessionErr);
     debugLog("runUnit", {
@@ -110,17 +121,20 @@ export async function runUnit(
   if (sessionTimeoutHandle) clearTimeout(sessionTimeoutHandle);
 
   if (sessionResult.cancelled) {
+    _consumePendingSwitchCancellation();
     debugLog("runUnit-session-timeout", { unitType, unitId });
     return { status: "cancelled", errorContext: { message: "Session creation timed out", category: "timeout", isTransient: true } };
   }
 
   if (!s.active) {
+    _consumePendingSwitchCancellation();
     return { status: "cancelled" };
   }
 
   if (s.currentUnitModel && typeof pi.setModel === "function") {
     const restored = await pi.setModel(s.currentUnitModel, { persist: false });
     if (!restored) {
+      _consumePendingSwitchCancellation();
       const message =
         `Failed to restore configured model ${s.currentUnitModel.provider}/${s.currentUnitModel.id} after session creation`;
       ctx.ui.notify(
@@ -141,10 +155,19 @@ export async function runUnit(
   // ── Create the agent_end promise (per-unit one-shot) ──
   // This happens after newSession completes so session-switch agent_end events
   // from the previous session cannot resolve the new unit.
+  _markSessionSwitchAbortGraceWindow();
   _setSessionSwitchInFlight(false);
   const unitPromise = new Promise<UnitResult>((resolve) => {
     _setCurrentResolve(resolve);
   });
+  const pendingSwitchCancellation = _consumePendingSwitchCancellation();
+  if (pendingSwitchCancellation) {
+    _clearCurrentResolve();
+    return {
+      status: "cancelled",
+      ...(pendingSwitchCancellation.errorContext ? { errorContext: pendingSwitchCancellation.errorContext } : {}),
+    };
+  }
 
   // ── Provider request-readiness pre-check (#4555) ──
   // Verify the provider can accept requests before dispatching. If the token
@@ -194,8 +217,12 @@ export async function runUnit(
   // Without this, a crashed agent that never emits agent_end hangs the loop (#3161).
   const supervisor = resolveAutoSupervisorConfig();
   const UNIT_HARD_TIMEOUT_MS = Math.max(
-    30_000,
-    ((supervisor.hard_timeout_minutes ?? 30) * 60 * 1000) + 30_000,
+    UNIT_FAILSAFE_BUFFER_MS,
+    ((supervisor.hard_timeout_minutes ?? 30) * 60 * 1000) + UNIT_FAILSAFE_BUFFER_MS,
+  );
+  const freshProgressMs = Math.max(
+    UNIT_FAILSAFE_BUFFER_MS,
+    ((supervisor.idle_timeout_minutes ?? 10) * 60 * 1000) + UNIT_FAILSAFE_BUFFER_MS,
   );
   let unitTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
   let result: UnitResult;
@@ -207,9 +234,45 @@ export async function runUnit(
 
     debugLog("runUnit", { phase: "awaiting-agent-end", unitType, unitId });
     const timeoutResult = new Promise<UnitResult>((resolve) => {
-      unitTimeoutHandle = setTimeout(() => {
+      const settleOrDefer = () => {
+        let runtime: AutoUnitRuntimeRecord | null;
+        try {
+          runtime = readUnitRuntimeRecord(s.basePath, unitType, unitId);
+        } catch (error) {
+          debugLog("runUnit", {
+            phase: "unit-failsafe-runtime-read-failed",
+            unitType,
+            unitId,
+            error: error instanceof Error ? error.message : String(error),
+          });
+          resolve({
+            status: "cancelled",
+            errorContext: {
+              message: "Unit hard timeout — supervision may have failed; runtime progress could not be read",
+              category: "timeout",
+              isTransient: true,
+            },
+          });
+          return;
+        }
+        if (shouldDeferUnitFailsafeTimeout(runtime, {
+          nowMs: Date.now(),
+          currentUnitStartedAt: s.currentUnit?.startedAt,
+          freshProgressMs,
+        })) {
+          debugLog("runUnit", {
+            phase: "unit-failsafe-deferred",
+            unitType,
+            unitId,
+            runtimePhase: runtime?.phase,
+            lastProgressKind: runtime?.lastProgressKind,
+          });
+          unitTimeoutHandle = setTimeout(settleOrDefer, UNIT_FAILSAFE_RECHECK_MS);
+          return;
+        }
         resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
-      }, UNIT_HARD_TIMEOUT_MS);
+      };
+      unitTimeoutHandle = setTimeout(settleOrDefer, UNIT_HARD_TIMEOUT_MS);
     });
     result = await runWithTurnGeneration(capturedTurnGen, () =>
       Promise.race([unitPromise, timeoutResult]),

package/src/resources/extensions/gsd/auto/session.ts

@@ -88,6 +88,7 @@ export class AutoSession {
   // ── Lifecycle ────────────────────────────────────────────────────────────
   active = false;
   paused = false;
+  completionStopInProgress = false;
   stepMode = false;
   verbose = false;
   activeEngineId: string | null = null;
@@ -109,7 +110,7 @@ export class AutoSession {
   workerId: string | null = null;
   /**
    * Active milestone lease fencing token, set by claimMilestoneLease() inside
-   * worktree-resolver.enterMilestone(). Threaded into recordDispatchClaim()
+   * WorktreeLifecycle.enterMilestone(). Threaded into recordDispatchClaim()
    * as milestone_lease_token so out-of-band dispatches by a stale worker
    * are detectable.
    */
@@ -158,6 +159,7 @@ export class AutoSession {
   pendingCrashRecovery: string | null = null;
   pendingVerificationRetry: PendingVerificationRetry | null = null;
   readonly verificationRetryCount = new Map<string, number>();
+  readonly verificationRetryFailureHashes = new Map<string, string>();
   pausedSessionFile: string | null = null;
   pausedUnitType: string | null = null;
   pausedUnitId: string | null = null;
@@ -178,6 +180,13 @@ export class AutoSession {
    * stale context bleeding into unrelated slices.
    */
   lastPreExecFailure: PreExecFailure | null = null;
+  /**
+   * Tracks how many consecutive times each slice unit has failed pre-execution
+   * checks. Keyed by unitId (e.g. "M001/S01"). Used to break the infinite
+   * plan-slice → pre-exec fail → re-dispatch loop when the planner cannot fix
+   * the issues after MAX_PRE_EXEC_RETRIES re-attempts.
+   */
+  readonly preExecRetryCount: Map<string, number> = new Map();
 
   // ── Tool invocation errors (#2883) ──────────────────────────────────
   /** Set when a GSD tool execution ends with isError due to malformed/truncated
@@ -279,6 +288,7 @@ export class AutoSession {
     // Lifecycle
     this.active = false;
     this.paused = false;
+    this.completionStopInProgress = false;
     this.stepMode = false;
     this.verbose = false;
     this.activeEngineId = null;
@@ -327,6 +337,7 @@ export class AutoSession {
     this.pendingCrashRecovery = null;
     this.pendingVerificationRetry = null;
     this.verificationRetryCount.clear();
+    this.verificationRetryFailureHashes.clear();
     this.pausedSessionFile = null;
     this.pausedUnitType = null;
     this.pausedUnitId = null;
@@ -343,6 +354,7 @@ export class AutoSession {
     this.rewriteAttemptCount = 0;
     this.consecutiveCompleteBootstraps = 0;
     this.lastPreExecFailure = null;
+    this.preExecRetryCount.clear();
     this.lastToolInvocationError = null;
     this.lastUnitAgentEndMessages = null;
     this.lastGitActionFailure = null;
@@ -364,6 +376,12 @@ export class AutoSession {
     // Loop promise state lives in auto-loop.ts module scope
   }
 
+  resetAfterStop(options: { preserveCompletionSurface?: boolean } = {}): void {
+    const completionStopInProgress = options.preserveCompletionSurface ? this.completionStopInProgress : false;
+    this.reset();
+    this.completionStopInProgress = completionStopInProgress;
+  }
+
   toJSON(): Record<string, unknown> {
     const orchestrationStatus = this.orchestration?.getStatus();
     return {

package/src/resources/extensions/gsd/auto/types.ts

@@ -45,6 +45,9 @@ export const BUDGET_THRESHOLDS: Array<{
  */
 export interface AgentEndEvent {
   messages: unknown[];
+  sessionId?: string;
+  turnId?: string;
+  abortOrigin?: "session-transition" | "user" | "timeout" | "unknown";
 }
 
 /**

package/src/resources/extensions/gsd/auto/unit-runner-events.ts

@@ -0,0 +1,15 @@
+// GSD-2 + src/resources/extensions/gsd/auto/unit-runner-events.ts - Classifies agent lifecycle events before Unit settlement.
+
+import type { AgentEndEvent } from "./types.js";
+
+export function isInternalSessionTransitionAbortEvent(
+  event: Pick<AgentEndEvent, "abortOrigin">,
+): boolean {
+  return event.abortOrigin === "session-transition";
+}
+
+export function shouldIgnoreAgentEndForActiveUnit(
+  event: Pick<AgentEndEvent, "abortOrigin">,
+): boolean {
+  return isInternalSessionTransitionAbortEvent(event);
+}

package/src/resources/extensions/gsd/auto/verification-retry-policy.ts

@@ -0,0 +1,82 @@
+// Project/App: GSD-2
+// File Purpose: Central retry policy for auto-mode verification redispatches.
+
+import { createHash } from "node:crypto";
+
+import type { PendingVerificationRetry } from "./session.js";
+
+export const VERIFICATION_RETRY_BASE_DELAY_MS = 2_000;
+export const VERIFICATION_RETRY_MAX_DELAY_MS = 30_000;
+export const VERIFICATION_RETRY_JITTER_RATIO = 0.1;
+
+export type VerificationRetryDecision =
+  | {
+      action: "delay";
+      key: string;
+      failureHash: string;
+      delayMs: number;
+      baseDelayMs: number;
+    }
+  | {
+      action: "pause";
+      reason: "missing-retry-context" | "duplicate-failure-context";
+      key?: string;
+      failureHash?: string;
+    };
+
+export function verificationRetryKey(unitType: string, unitId: string): string {
+  return `${unitType}:${unitId}`;
+}
+
+export function hashVerificationFailureContext(failureContext: string): string {
+  const normalized = failureContext.replace(/\r\n/g, "\n").trim();
+  return createHash("sha256").update(normalized).digest("hex");
+}
+
+export function verificationRetryDelayMs(
+  attempt: number,
+  random: () => number = Math.random,
+): { delayMs: number; baseDelayMs: number } {
+  const safeAttempt = Math.max(1, Math.floor(attempt));
+  const baseDelayMs = Math.min(
+    VERIFICATION_RETRY_MAX_DELAY_MS,
+    VERIFICATION_RETRY_BASE_DELAY_MS * 2 ** (safeAttempt - 1),
+  );
+  const jitterSpanMs = Math.round(baseDelayMs * VERIFICATION_RETRY_JITTER_RATIO);
+  const jitterMs = Math.round((random() - 0.5) * 2 * jitterSpanMs);
+  const delayMs = Math.min(
+    VERIFICATION_RETRY_MAX_DELAY_MS,
+    Math.max(0, baseDelayMs + jitterMs),
+  );
+  return { delayMs, baseDelayMs };
+}
+
+export function decideVerificationRetry(input: {
+  unitType: string | undefined;
+  retryInfo: PendingVerificationRetry | null | undefined;
+  previousFailureHash: string | undefined;
+  random?: () => number;
+}): VerificationRetryDecision {
+  const { retryInfo, unitType } = input;
+  if (!retryInfo || !unitType) {
+    return { action: "pause", reason: "missing-retry-context" };
+  }
+
+  const key = verificationRetryKey(unitType, retryInfo.unitId);
+  const failureHash = hashVerificationFailureContext(retryInfo.failureContext);
+  if (input.previousFailureHash === failureHash) {
+    return {
+      action: "pause",
+      reason: "duplicate-failure-context",
+      key,
+      failureHash,
+    };
+  }
+
+  return {
+    action: "delay",
+    key,
+    failureHash,
+    ...verificationRetryDelayMs(retryInfo.attempt, input.random),
+  };
+}

package/src/resources/extensions/gsd/auto/workflow-dispatch-claim.ts

@@ -9,6 +9,16 @@ export type DispatchClaimOutcome =
   | { kind: "skip"; reason: "already-active" | "stale-lease"; existingId?: number; existingWorker?: string }
   | { kind: "degraded" };
 
+export type DispatchLeaseOutcome =
+  | { kind: "ready"; token: number; recovered: boolean }
+  | { kind: "degraded"; reason: "missing-worker" | "missing-milestone" }
+  | { kind: "blocked"; reason: string }
+  | { kind: "failed"; reason: string };
+
+type ClaimMilestoneLeaseResult =
+  | { ok: true; token: number; expiresAt: string }
+  | { ok: false; error: "held_by"; byWorker: string; expiresAt: string };
+
 interface RecentDispatch {
   attempt_n?: number | null;
 }
@@ -44,6 +54,58 @@ export interface OpenDispatchClaimDeps {
   logClaimFailed: (err: unknown) => void;
 }
 
+export interface EnsureDispatchLeaseDeps {
+  claimMilestoneLease: (workerId: string, milestoneId: string) => ClaimMilestoneLeaseResult;
+  logLeaseRecovered: (details: {
+    milestoneId: string;
+    workerId: string;
+    token: number;
+    recovered: boolean;
+  }) => void;
+  logLeaseRecoveryFailed: (details: {
+    milestoneId?: string;
+    workerId?: string;
+    reason: string;
+  }) => void;
+}
+
+export function ensureDispatchLease(
+  s: AutoSession,
+  milestoneId: string | undefined,
+  deps: EnsureDispatchLeaseDeps,
+  opts: { forceReclaim?: boolean } = {},
+): DispatchLeaseOutcome {
+  if (!s.workerId) return { kind: "degraded", reason: "missing-worker" };
+  if (!milestoneId) return { kind: "degraded", reason: "missing-milestone" };
+  if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+    return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+  }
+
+  s.milestoneLeaseToken = null;
+  try {
+    const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+    if (!claim.ok) {
+      const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+      deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+      return { kind: "blocked", reason };
+    }
+
+    s.currentMilestoneId = milestoneId;
+    s.milestoneLeaseToken = claim.token;
+    deps.logLeaseRecovered({
+      milestoneId,
+      workerId: s.workerId,
+      token: claim.token,
+      recovered: opts.forceReclaim === true,
+    });
+    return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+    return { kind: "failed", reason };
+  }
+}
+
 export function openDispatchClaim(
   s: AutoSession,
   flowId: string,
@@ -51,7 +113,7 @@ export function openDispatchClaim(
   iterData: IterationData,
   deps: OpenDispatchClaimDeps,
 ): DispatchClaimOutcome {
-  if (!s.workerId || s.milestoneLeaseToken === null) return { kind: "degraded" };
+  if (!s.workerId || typeof s.milestoneLeaseToken !== "number") return { kind: "degraded" };
   const mid = iterData.mid;
   if (!mid) return { kind: "degraded" };
 

package/src/resources/extensions/gsd/auto/workflow-worker-heartbeat.ts

@@ -15,6 +15,11 @@ export interface MaintainWorkerHeartbeatDeps {
     fencingToken: number,
   ) => boolean;
   logHeartbeatFailure: (err: unknown) => void;
+  logLeaseRefreshMiss?: (details: {
+    workerId: string;
+    milestoneId: string;
+    fencingToken: number;
+  }) => void;
 }
 
 export function maintainWorkerHeartbeat(
@@ -26,11 +31,19 @@ export function maintainWorkerHeartbeat(
   try {
     deps.heartbeatAutoWorker(session.workerId);
     if (session.currentMilestoneId && session.milestoneLeaseToken) {
-      deps.refreshMilestoneLease(
+      const refreshed = deps.refreshMilestoneLease(
         session.workerId,
         session.currentMilestoneId,
         session.milestoneLeaseToken,
       );
+      if (!refreshed) {
+        deps.logLeaseRefreshMiss?.({
+          workerId: session.workerId,
+          milestoneId: session.currentMilestoneId,
+          fencingToken: session.milestoneLeaseToken,
+        });
+        session.milestoneLeaseToken = null;
+      }
     }
   } catch (err) {
     deps.logHeartbeatFailure(err);