@opengsd/gsd-core 1.20.0 → 1.21.0

package/gsd-core/bin/lib/phase-locator.cjs

@@ -47,7 +47,7 @@ const { planningDir, planningRoot, resolveEnvWorkstream, resolvePhaseIdConventio
 // Naming readers and writers share the loader's scoped-key precedence and defaults.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderModule = require("./config-loader.cjs");
-const { CONFIG_DEFAULTS, _deepMergeConfig, _getConfigValue, loadConfig } = configLoaderModule;
+const { CONFIG_DEFAULTS, _deepMergeConfig, _getConfigValue, loadConfig, readConfigFileBounded } = configLoaderModule;
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatterModule = require("./frontmatter.cjs");
@@ -253,7 +253,12 @@ function phaseDirectoryOptions(cwd, config, roadmap, ws) {
     if (naming === undefined) {
         const readConfig = (file) => {
             try {
-                const value = JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
+                // Bounded read (#5759): null is an absent file (no configError); a FIFO/device/oversized
+                // file throws and is reported through configError like any other unreadable config.
+                const raw = readConfigFileBounded(file);
+                if (raw === null)
+                    return null;
+                const value = JSON.parse(raw);
                 if (value && typeof value === 'object' && !Array.isArray(value))
                     return value;
                 configError = { path: file, message: 'configuration must be a JSON object' };
@@ -305,7 +310,7 @@ function phaseDirectoryOptions(cwd, config, roadmap, ws) {
                 // Windows may omit these flags: lstat/fstat still require a regular file,
                 // but the open is not atomically no-follow there. Adopt Windows no-follow
                 // flags here if Node exposes them; no caller should weaken these checks.
-                identityFd = node_fs_1.default.openSync(markerPath, node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK | node_fs_1.default.constants.O_NOFOLLOW);
+                identityFd = node_fs_1.default.openSync(markerPath, node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK | node_fs_1.default.constants.O_NOFOLLOW | (node_fs_1.default.constants.O_NOCTTY ?? 0));
                 const opened = node_fs_1.default.fstatSync(identityFd);
                 if (!opened.isFile() || opened.size > 1024)
                     continue;

package/gsd-core/bin/lib/phase.cjs

@@ -42,7 +42,7 @@ const coreUtilsMod = require("./core-utils.cjs");
 const { toPosixPath, generateSlugInternal, readSubdirectories, extractCanonicalPlanId, findUnsummarizedPlans, } = coreUtilsMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-id.cjs is an export= CommonJS module
 const phaseIdMod = require("./phase-id.cjs");
-const { normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, matchPhaseDirs, phaseLookupQuery, phaseNumberForMatch, phaseKeyFromDir, customPhaseDirectoryParts, customDirectoryOwner, phaseScanTokenSource, CUSTOM_PHASE_ID_FILE, isCustomPhaseId, isSentinelPhaseId, scopeToPhase, parsePhaseId, renderPhaseId, renderMilestoneId, toDir, phaseHeadingPrefixSrcFor, parsePhaseChecklistLine, PHASE_HEADING_BASELINE, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, OPTIONAL_PHASE_TAG_SOURCE, PHASE_NUMBER_TOKEN_SOURCE, buildPhaseDeclarationScans, BRACKET_DIR_PREFIX_SRC, tokenizePhaseDependencyReferences, foldBracketId, } = phaseIdMod;
+const { normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, matchPhaseDirs, phaseLookupQuery, phaseNumberForMatch, phaseKeyFromDir, customPhaseDirectoryParts, customDirectoryOwner, phaseScanTokenSource, phaseNumberTokenSource, CUSTOM_PHASE_ID_FILE, isCustomPhaseId, isSentinelPhaseId, scopeToPhase, parsePhaseId, renderPhaseId, renderMilestoneId, toDir, phaseHeadingPrefixSrcFor, parsePhaseChecklistLine, PHASE_HEADING_BASELINE, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, OPTIONAL_PHASE_TAG_SOURCE, PHASE_NUMBER_TOKEN_SOURCE, buildPhaseDeclarationScans, BRACKET_DIR_PREFIX_SRC, tokenizePhaseDependencyReferences, foldBracketId, } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdDisplayMod = require("./phase-id-display.cjs");
 // #4304: reuse the Phase Id Display Module's milestone/phase
@@ -51,6 +51,7 @@ const phaseIdDisplayMod = require("./phase-id-display.cjs");
 const { milestoneToken, phaseToken } = phaseIdDisplayMod;
 const phase_entry_grammar_cjs_1 = require("./phase-entry-grammar.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
+const markdown_table_cjs_1 = require("./markdown-table.cjs");
 const gate_exit_cjs_1 = require("./gate-exit.cjs");
 const gate_verdict_cjs_1 = require("./gate-verdict.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
@@ -61,7 +62,10 @@ const planningScopeMod = require("./planning-scope.cjs");
 const { SCOPE } = planningScopeMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- roadmap-parser.cjs is an export= CommonJS module
 const roadmapParserMod = require("./roadmap-parser.cjs");
-const { stripShippedMilestones, extractCurrentMilestone, currentMilestoneRawRanges, withPhaseSection, editCurrentMilestone, findMilestoneScopeHeadingLines, getMilestoneInfo, scanMilestonePhaseIds, 
+const { stripShippedMilestones, extractCurrentMilestone, extractCurrentMilestoneScoped, currentMilestoneRawRanges, withPhaseSection, editCurrentMilestone, findMilestoneScopeHeadingLines, getMilestoneInfo, 
+// #5679: the STATE.md milestone read getMilestoneInfo itself uses, and the
+// archive-aware owner of a ROADMAP offset.
+readStateMilestoneScalar, classifyMilestoneScalar, milestoneVersionAtOffset, blankCodeAndComments, scanMilestonePhaseIds, 
 // #4304: every recognized milestone heading in the document,
 // not just the active one — see bracketProgressSectionOwnedByOtherMilestone.
 listMilestoneHeadings, selectMilestoneHeading, 
@@ -94,7 +98,7 @@ const planning_document_cjs_1 = require("./planning-document.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const clock_cjs_1 = require("./clock.cjs");
 const state_transition_cjs_1 = require("./state-transition.cjs");
-const markdown_table_cjs_1 = require("./markdown-table.cjs");
+const markdown_table_cjs_2 = require("./markdown-table.cjs");
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const security_cjs_1 = require("./security.cjs");
 // #5060: the Phase Status Module owns the ROADMAP Status-cell token vocabulary.
@@ -496,6 +500,9 @@ function cmdFindPhase(cwd, phase, raw) {
     const directoryContext = phaseDirectoryOptions(cwd);
     const lookup = resolvePhaseDirectoryLookup(cwd, phase, undefined, directoryContext);
     const { normalized, convention } = lookup;
+    // #5676: `lookup.convention` is only ever 'bracket'; the directory token grammar
+    // (`03-02-beta` -> `03-02` + `beta`) needs the repo's own convention.
+    const tokenConvention = resolvePhaseIdConvention(cwd);
     const notFound = {
         found: false,
         directory: null,
@@ -561,7 +568,7 @@ function cmdFindPhase(cwd, phase, raw) {
                 && BRACKET_DIRECTORY_PREFIX_RE.test(foldBracketId(match));
             const dirMatch = isBracketDirectory
                 ? null
-                : match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i')) || match.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i'));
+                : match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(${phaseNumberTokenSource(tokenConvention)})-?(.*)`, 'i')) || match.match(new RegExp(`^(${phaseNumberTokenSource(tokenConvention)})-?(.*)`, 'i'));
             const customParts = custom ? customPhaseDirectoryParts(match, custom) : null;
             const phaseNumber = isBracketDirectory
                 ? phaseNumberForMatch(match, usedBareFallback, convention)
@@ -1244,7 +1251,7 @@ function recordNewPhase(raw, cwd, id, description, after, label) {
         if (findPhaseTableHeader(scoped) === -1)
             return scoped;
         const cell = { Phase: `${id}. ${description}`, 'Plans Complete': '0/0', Status: 'Not started' };
-        const r = (0, markdown_table_cjs_1.insertTableRow)(scoped, (col) => cell[col]);
+        const r = (0, markdown_table_cjs_2.insertTableRow)(scoped, (col) => cell[col]);
         if (!r.ok)
             return scoped;
         wrote = true;
@@ -1635,6 +1642,54 @@ function assertBracketGeneratedIdentity(command, config, customId) {
             'Custom naming precedence under the bracket convention lands with #5067.');
     }
 }
+const STATE_MILESTONE_ECHO_LIMIT = 80;
+/**
+ * #5726: STATE.md's `milestone:` value is untrusted text. Cap it at
+ * `STATE_MILESTONE_ECHO_LIMIT` characters (ellipsis past the cap), then quote it
+ * with `JSON.stringify` (the `phase.cts` precedent for echoed user text), which
+ * escapes ESC/BEL/newlines; the characters JSON leaves raw but a terminal acts on
+ * are escaped too: DEL and C1 controls, zero-width and direction marks
+ * (U+200B-U+200F), line/paragraph separators and bidi embeddings/overrides
+ * (U+2028-U+202E), the invisible-format block (U+2060-U+206F, incl. bidi
+ * isolates), soft hyphen (U+00AD), Arabic letter mark (U+061C), Mongolian
+ * vowel separator (U+180E), interlinear annotations (U+FFF9-U+FFFB) and the
+ * BOM (U+FEFF).
+ */
+function echoStateMilestone(value) {
+    const chars = Array.from(value);
+    const capped = chars.length > STATE_MILESTONE_ECHO_LIMIT
+        ? `${chars.slice(0, STATE_MILESTONE_ECHO_LIMIT).join('')}…`
+        : value;
+    return JSON.stringify(capped).replace(/[\u007f-\u009f\u{ad}\u{61c}\u{180e}\u{200b}-\u{200f}\u{2028}-\u{202e}\u{2060}-\u{206f}\u{feff}\u{fff9}-\u{fffb}]/gu, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+/**
+ * #5726: the current-milestone window for a verb that WRITES to the ROADMAP.
+ * When STATE.md names a milestone that has no heading in a ROADMAP carrying
+ * versioned milestones, the window owner falls back to the whole unshipped
+ * roadmap (scope UNSCOPED, `unresolvedMilestone` set), and number allocation,
+ * the `Depends on` line and the insert target would run over every milestone.
+ * ADR-3180: that is a non-answer, refused where it is destructive. Refuses
+ * before any write, naming the milestone; every other scope (a real heading,
+ * a free-form legacy ROADMAP, no milestone field) returns the window unchanged.
+ * Read-only readers keep calling `extractCurrentMilestone` and keep degrading.
+ */
+function currentMilestoneWindowOrRefuse(rawContent, cwd, command) {
+    const { value, unresolvedMilestone, shippedMilestone } = extractCurrentMilestoneScoped(rawContent, cwd);
+    if (shippedMilestone) {
+        error(`${command}: STATE.md names milestone ${echoStateMilestone(shippedMilestone)}, which ROADMAP.md marks as already shipped, `
+            + 'so the current milestone window is a closed one. Refusing to number the phase or link its dependencies '
+            + 'against a shipped milestone. Start the next milestone (or correct the milestone field in STATE.md), then retry. '
+            + 'If the heading is not shipped and its title merely contains a status word (such as "Failed Payment Recovery"), '
+            + 'rename the milestone, or add an active marker to the heading, for example \u{1f6a7} or "(in progress)".');
+    }
+    if (unresolvedMilestone) {
+        error(`${command}: STATE.md names milestone ${echoStateMilestone(unresolvedMilestone)}, but ROADMAP.md has no milestone heading for it, `
+            + 'so the current milestone window cannot be resolved. Refusing to use the whole roadmap, which would number '
+            + 'the phase and link its dependencies against other milestones. Add the milestone heading to ROADMAP.md '
+            + 'or correct the milestone field in STATE.md, then retry.');
+    }
+    return value;
+}
 /**
  * #4304: refuse a bracket `phase add` / `add-batch` whose located milestone
  * window is a decoy. A non-milestone heading carrying the active version
@@ -1706,9 +1761,9 @@ function cmdPhaseAdd(cwd, description, raw, customId) {
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, config) : null;
     const { newPhaseId, dirName, roadmapEntry } = withPlanningLock(cwd, () => {
         const rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase add');
         if (bracketContext)
             assertBracketAddWindowLocated(rawContent, cwd, bracketContext, 'phase add');
-        const content = extractCurrentMilestone(rawContent, cwd);
         let _newPhaseId;
         let _dirName = '';
         if (bracketContext) {
@@ -1815,9 +1870,9 @@ function cmdPhaseAddBatch(cwd, descriptions, raw) {
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, config) : null;
     const results = withPlanningLock(cwd, () => {
         let rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase add-batch');
         if (bracketContext)
             assertBracketAddWindowLocated(rawContent, cwd, bracketContext, 'phase add-batch');
-        const content = extractCurrentMilestone(rawContent, cwd);
         let maxPhase = 0;
         if (bracketContext) {
             const used = collectBracketPhaseNumbers(content, node_path_1.default.join(planningDir(cwd), 'phases'), bracketContext);
@@ -2187,6 +2242,34 @@ function isPhaseTokenWithin(token, ancestor) {
     const canon = (segment) => segment.replace(/^0+(?=\d)/, '').toLowerCase();
     return a.every((segment, i) => canon(segment) === canon(t[i]));
 }
+/**
+ * #5679: the `phase insert` error for a phase that exists in the ROADMAP but
+ * outside the current milestone. Names the milestone that holds it (archive
+ * aware, never the current one) and the current milestone, saying "STATE.md's"
+ * only when STATE.md's `milestone:` is where that version came from.
+ */
+function otherMilestonePhaseMessage(rawContent, foundAt, cwd, afterPhase) {
+    let stateVersion = null;
+    try {
+        const stateRaw = (0, shell_command_projection_cjs_1.platformReadSync)(node_path_1.default.join(planningDir(cwd), 'STATE.md'));
+        const scalar = stateRaw === null ? null : readStateMilestoneScalar(stateRaw);
+        if (scalar !== null)
+            stateVersion = classifyMilestoneScalar(scalar).version;
+    }
+    catch { /* unreadable STATE.md: getMilestoneInfo's own fallback below decides */ }
+    const derivedVersion = getMilestoneInfo(cwd).value?.version ?? null;
+    const current = stateVersion ?? derivedVersion;
+    const owner = milestoneVersionAtOffset(rawContent, foundAt);
+    const ownerClause = owner && owner.toLowerCase() !== current?.toLowerCase()
+        ? `is in milestone ${owner}`
+        : 'is outside the current milestone';
+    let currentClause = 'the current milestone does not include it';
+    if (stateVersion)
+        currentClause = `STATE.md's current milestone is ${stateVersion}`;
+    else if (derivedVersion)
+        currentClause = `the current milestone is ${derivedVersion}`;
+    return `Phase ${afterPhase} ${ownerClause}, but ${currentClause}. phase insert only targets phases in the current milestone.`;
+}
 function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested') {
     if (!afterPhase || !description) {
         error('after-phase and description required for phase insert');
@@ -2202,7 +2285,7 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, insertConfig) : null;
     const { decimalPhase, dirName, roadmapEntry } = withPlanningLock(cwd, () => {
         const rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
-        const content = extractCurrentMilestone(rawContent, cwd);
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase insert');
         // #4304: canonicalize a bracket argument
         // through the SAME adapter `phase remove` uses
         // (canonicalizeBracketPhaseArgument) instead of the legacy
@@ -2257,7 +2340,8 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
         const anyHeadingPattern = new RegExp(`#{2,4}\\s*${phaseHeadingPrefixSrcFor(PHASE_HEADING_BASELINE.LABEL_ONLY, insertConvention)}\\d`, 'i');
         const roadmapHasHeadingPhases = anyHeadingPattern.test(content);
         // #4304: bracket identities live in headings only, so a bracket ROADMAP never takes the legacy bullet-insertion branch — a bullet-only bracket ROADMAP falls through to the checklist-refusal path below instead.
-        const isBulletStyle = !bracketContext && !headingMatch && bulletPattern.test(content) && !roadmapHasHeadingPhases;
+        const liveCurrent = blankCodeAndComments(content);
+        const isBulletStyle = !bracketContext && !headingMatch && bulletPattern.test(liveCurrent) && !roadmapHasHeadingPhases;
         if (bracketContext && !bracketHeading) {
             const searchedRanges = bracketSectionRanges?.details
                 ? 'primary and Phase Details ranges'
@@ -2266,9 +2350,19 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
         }
         if (!headingMatch && !isBulletStyle) {
             const checklistPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`${headingIntro}${afterPhaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}[:\\s]`, 'i');
-            if (checklistPattern.test(content)) {
+            if (checklistPattern.test(liveCurrent)) {
                 error(`Phase ${afterPhase} exists in roadmap summary but is missing a detail section (### Phase ${afterPhase}: ...).`);
             }
+            // #5679: this whole-file probe only chooses the error message; insert
+            // stays current-milestone-only and never writes to another milestone.
+            // Fenced blocks and HTML comments are masked (same length, offsets stay aligned) so example text never counts as a phase.
+            const liveContent = blankCodeAndComments(rawContent);
+            const headingOffset = (0, markdown_sectionizer_cjs_1.tokenizeHeadings)(liveContent).find((h) => targetPattern.test(h.text))?.offset;
+            const checklistOffset = checklistPattern.exec(liveContent)?.index;
+            const foundOffsets = [headingOffset, checklistOffset].filter((o) => o !== undefined);
+            if (foundOffsets.length > 0) {
+                error(otherMilestonePhaseMessage(rawContent, Math.min(...foundOffsets), cwd, afterPhase));
+            }
             error(`Phase ${afterPhase} not found in ROADMAP.md`);
         }
         const phasesDir = node_path_1.default.join(planningDir(cwd), 'phases');
@@ -2333,7 +2427,7 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
         let roadmapEntry;
         if (isBulletStyle) {
             const boldBulletPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+${afterPhaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}:`, 'i', { bold: 'required' });
-            const useBold = boldBulletPattern.test(content);
+            const useBold = boldBulletPattern.test(liveCurrent);
             const phaseLabel = useBold
                 ? `**Phase ${_decimalPhase}: ${description}**`
                 : `Phase ${_decimalPhase}: ${description}`;
@@ -2356,11 +2450,12 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
             // true line-content boundary so bulletLineEnd lands cleanly before the
             // terminator.
             const targetBulletPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+${afterPhaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}[:\\s][^\\r\\n]*`, 'i');
-            const bulletMatchResult = rawContent.match(targetBulletPattern);
+            // Match against the masked text (same length, offsets aligned) so a fenced or commented example bullet is never the splice anchor; splice into the original text at the masked match index.
+            const bulletMatchResult = blankCodeAndComments(rawContent).match(targetBulletPattern);
             if (!bulletMatchResult) {
                 error(`Could not find Phase ${afterPhase} bullet line`);
             }
-            const bulletLineEnd = rawContent.indexOf(bulletMatchResult[0]) + bulletMatchResult[0].length;
+            const bulletLineEnd = bulletMatchResult.index + bulletMatchResult[0].length;
             const afterBullet = rawContent.slice(bulletLineEnd);
             // #5599: land after the last bullet inside the allocation family's
             // subtree, not before the first following bullet of any number (which is
@@ -2791,7 +2886,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
             return parseInt(leadingMatch[1], 10) === removedInt;
         };
         content = (0, roadmap_progress_cjs_1.editRoadmapProgress)(content, (progressSection) => {
-            const deleteResult = (0, markdown_table_cjs_1.deleteTableRow)(progressSection, matchRemovedProgressRow);
+            const deleteResult = (0, markdown_table_cjs_2.deleteTableRow)(progressSection, matchRemovedProgressRow);
             return deleteResult.ok ? deleteResult.value : progressSection;
         }, { headingless: 'skip' });
         if (!isDecimal && !customTarget) {
@@ -2871,7 +2966,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
                 let matchedRowIndex = null;
                 for (;;) {
                     matchedRowIndex = null;
-                    const cellResult = (0, markdown_table_cjs_1.updateTableCell)(ordinalSection, (row, index) => {
+                    const cellResult = (0, markdown_table_cjs_2.updateTableCell)(ordinalSection, (row, index) => {
                         if (processedOrdinalRows.has(index))
                             return false;
                         const m = phaseCellShapeRe.exec(row['Phase'] ?? '');
@@ -2892,11 +2987,11 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
                         const newContent = `${decremented}${m[2]}${current.slice(m[0].length)}`;
                         const targetLine = matchedRowIndex === null ? null : findDataRowLine(ordinalSection, matchedRowIndex);
                         const padMatch = targetLine
-                            ? new RegExp(`^[ \\t]*\\|(\\s*)${(0, pattern_cjs_1.escapeRegex)((0, markdown_table_cjs_1.escapeCell)(current))}(\\s*)\\|`).exec(targetLine)
+                            ? new RegExp(`^[ \\t]*\\|(\\s*)${(0, pattern_cjs_1.escapeRegex)((0, markdown_table_cjs_2.escapeCell)(current))}(\\s*)\\|`).exec(targetLine)
                             : null;
                         const leadPad = padMatch ? padMatch[1] : ' ';
                         const trailPad = padMatch ? padMatch[2] : ' ';
-                        return `${leadPad}${(0, markdown_table_cjs_1.escapeCell)(newContent)}${trailPad}`;
+                        return `${leadPad}${(0, markdown_table_cjs_2.escapeCell)(newContent)}${trailPad}`;
                     });
                     if (!cellResult.ok)
                         break;
@@ -3486,7 +3581,7 @@ function classifyBracketOwnedLine(line) {
     if (checklistId)
         return { kind: 'checklist', id: checklistId };
     if (/^[ \t]*\|/.test(line)) {
-        const firstCell = (0, markdown_table_cjs_1.splitTableRow)(line)[0]?.replace(/^\*\*(.*)\*\*$/, '$1') ?? '';
+        const firstCell = (0, markdown_table_cjs_2.splitTableRow)(line)[0]?.replace(/^\*\*(.*)\*\*$/, '$1') ?? '';
         const progressId = phaseIdFromOwnedLineMatch(BRACKET_CELL_ID_RE.exec(firstCell));
         if (progressId)
             return { kind: 'progress', id: progressId };
@@ -4848,7 +4943,7 @@ function phaseDisplayNameFromRoadmap(roadmapContent, phaseNum) {
     const heading = matchedHeading.text.match(headingPattern);
     if (!heading)
         return null;
-    const name = heading[1].replace(/\(INSERTED\)/i, '').trim();
+    const name = (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(heading[1]);
     return name || null;
 }
 function phaseDisplayNameFromSlug(slug) {
@@ -6027,12 +6122,12 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // (`editProgressTableSlice` -> `editRoadmapProgress`), the same one `roadmap update-plan-progress` uses.
                     s = editProgressTableSlice(s, (scoped) => {
                         let text = scoped;
-                        const plansResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Plans Complete', ` ${summaryCount}/${planCount} `);
+                        const plansResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Plans Complete', ` ${summaryCount}/${planCount} `);
                         if (plansResult.ok)
                             text = plansResult.value;
                         // #5165: a Status cell that already reads Complete is left untouched —
                         // re-padding it rewrote a cell the re-run had no business editing.
-                        const statusResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Status', (current) => (0, phase_status_cjs_1.parseRoadmapStatusCell)(current) === phase_status_cjs_1.WIRE_STATUS.COMPLETE
+                        const statusResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Status', (current) => (0, phase_status_cjs_1.parseRoadmapStatusCell)(current) === phase_status_cjs_1.WIRE_STATUS.COMPLETE
                             ? current
                             : ` ${(0, phase_status_cjs_1.toRoadmapStatusCell)(phase_status_cjs_1.PHASE_STATUS.COMPLETE).padEnd(11)} `);
                         if (statusResult.ok)
@@ -6044,7 +6139,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         // findTableWithColumns (which requires the WHOLE table to parse —
                         // a ragged SIBLING row elsewhere used to silently no-op this
                         // row's date stamp too).
-                        const completedResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Completed', (current) => dateShape.test(current.trim()) ? current : ` ${today} `);
+                        const completedResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Completed', (current) => dateShape.test(current.trim()) ? current : ` ${today} `);
                         if (completedResult.ok)
                             text = completedResult.value;
                         return text;
@@ -6182,7 +6277,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                             // checkbox rollback below can distinguish "row existed and accepted" from
                             // "row existed and rejected".
                             let tableHit = false;
-                            const reqUpdate = (0, markdown_table_cjs_1.updateTraceabilityCell)(reqContent, reqRowMatch, 'Status', (current) => {
+                            const reqUpdate = (0, markdown_table_cjs_2.updateTraceabilityCell)(reqContent, reqRowMatch, 'Status', (current) => {
                                 // #2788: accept `Gaps Found` too so a phase stranded by revert-phase (the
                                 // gaps_found response) can complete without hand-editing the table.
                                 if (/^(?:pending|in progress|gaps found)$/i.test(current.trim())) {
@@ -6359,9 +6454,9 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // which section (deferred or not) it lives under.
                     const reqIsRegisteredAnywhere = (id) => {
                         const reqEscaped = (0, pattern_cjs_1.escapeRegex)(id);
-                        // Surface 1 — checkbox, EITHER state (`[ ]` or `[x]`), case-
-                        // insensitive: existence check, not the write's space-only match.
-                        if (new RegExp(`-\\s*\\[[ xX]\\]\\s*\\*\\*${reqEscaped}\\*\\*`, 'i').test(reqContent)) {
+                        // Surface 1 — checkbox, ANY single mark (`[ ]`, `[x]`, `[~]`, …; #5844),
+                        // case-insensitive: existence check, not the write's space-only match.
+                        if (new RegExp(`-\\s*\\[[^\\]\\r\\n]\\]\\s*\\*\\*${reqEscaped}\\*\\*`, 'i').test(reqContent)) {
                             return true;
                         }
                         // Surface 2 — Traceability row exists at all (any Status value),
@@ -6369,7 +6464,10 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         // technique milestone.cts's `hasRow` uses (:210-214): a case-
                         // insensitive first-cell match, regardless of current Status.
                         const rowProbeMatch = (row) => (Object.values(row)[0] ?? '').trim().toLowerCase() === id.toLowerCase();
-                        return (0, markdown_table_cjs_1.updateTraceabilityCell)(reqContent, rowProbeMatch, 'Status', (current) => current).ok;
+                        // #5844: a table with no Status column fails the probe above with
+                        // `unknown column`, so row existence is also read directly.
+                        return (0, markdown_table_cjs_2.updateTraceabilityCell)(reqContent, rowProbeMatch, 'Status', (current) => current).ok
+                            || (0, markdown_table_cjs_1.traceabilityRowExists)(reqContent, id);
                     };
                     const ghostReqIds = citedReqIds.filter((id) => !isPlaceholderReqId(id) && !reqIsRegisteredAnywhere(id));
                     if (ghostReqIds.length > 0) {
@@ -6381,8 +6479,15 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // IDs already reported above as ghosts to avoid a duplicate message
                     // for the same root cause.
                     const traceabilityWriteFailures = traceabilityWriteMisses.filter((id) => !ghostReqIds.includes(id));
-                    if (traceabilityWriteFailures.length > 0) {
-                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (no matching row found): ${traceabilityWriteFailures.join(', ')}`);
+                    // #5844: a row that EXISTS but has no Status cell to write is not a
+                    // missing row — name the real cause instead of blaming the row.
+                    const noStatusCellIds = traceabilityWriteFailures.filter((id) => (0, markdown_table_cjs_1.traceabilityRowExists)(reqContent, id));
+                    const noRowIds = traceabilityWriteFailures.filter((id) => !noStatusCellIds.includes(id));
+                    if (noRowIds.length > 0) {
+                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (no matching row found): ${noRowIds.join(', ')}`);
+                    }
+                    if (noStatusCellIds.length > 0) {
+                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (row found but the table has no Status column to write): ${noStatusCellIds.join(', ')}`);
                     }
                     writes.push({ filePath: reqPath, before: originalReqContent, after: reqContent });
                     // #2316-3: `requirements_updated` must reflect whether REQUIREMENTS.md
@@ -6424,6 +6529,9 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
             //      where the roadmap would give `2` and a slugified title. Promoting the
             //      roadmap without this would silently change the reported value on
             //      every aligned project, which is the majority case.
+            // #5676: the numeric phase-token grammar follows the convention, so a
+            // milestone-prefixed `03-02-beta` is phase `3-02`, not phase `3`.
+            const phaseConvention = resolvePhaseIdConvention(cwd);
             let diskNextNum = null;
             let diskNextName = null;
             let roadmapNextNum = null;
@@ -6442,7 +6550,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
             if (roadmapContent !== null) {
                 try {
                     const milestoneForComplete = extractCurrentMilestone(roadmapContent, cwd);
-                    const completePattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+(${phaseScanTokenSource(directoryContext)})`, 'gi');
+                    const completePattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+(${phaseScanTokenSource(directoryContext, phaseConvention)})`, 'gi');
                     let cm;
                     while ((cm = completePattern.exec(milestoneForComplete)) !== null) {
                         if (!(0, phase_entry_grammar_cjs_1.isPhaseEntryChecked)(cm[0]))
@@ -6472,7 +6580,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                 for (const dir of dirs) {
                     const custom = phaseIdMod.customPhaseQuery(dir, directoryContext);
                     const owner = custom && customDirectoryOwner(dir, custom);
-                    const dm = owner ? [dir, owner.id, owner.slug] : dir.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})-?(.*)`, 'i'));
+                    const dm = owner ? [dir, owner.id, owner.slug] : dir.match(new RegExp(`^(${phaseNumberTokenSource(phaseConvention)})-?(.*)`, 'i'));
                     if (dm) {
                         // #3185: canonical sentinel predicate (SENTINEL_RANGES [0,999]) — this was a local 999-only literal that admitted Phase 0.
                         if (isSentinelPhaseId(dm[1]))
@@ -6535,8 +6643,8 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // checkbox branch widens, and only to the separators #2199 already
                     // accepts. The two branches keep separate capture groups, normalized
                     // just below the loop.
-                    const phasePattern = new RegExp(`(?:#{2,4}\\s*(?:\\*\\*|__)?\\s*Phase\\s+(${phaseScanTokenSource(directoryContext)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n*]+)` +
-                        `|${(0, phase_entry_grammar_cjs_1.phaseEntryPrefixSrc)()}Phase\\s+(${phaseScanTokenSource(directoryContext)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*[—–:\\-]\\s*([^\\n*]+))`, 'gim');
+                    const phasePattern = new RegExp(`(?:#{2,4}\\s*(?:\\*\\*|__)?\\s*Phase\\s+(${phaseScanTokenSource(directoryContext, phaseConvention)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n*]+)` +
+                        `|${(0, phase_entry_grammar_cjs_1.phaseEntryPrefixSrc)()}Phase\\s+(${phaseScanTokenSource(directoryContext, phaseConvention)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*[—–:\\-]\\s*([^\\n*]+))`, 'gim');
                     let pm;
                     while ((pm = phasePattern.exec(roadmapForPhases)) !== null) {
                         // #4078: normalize the two alternation branches' captures (heading
@@ -6570,9 +6678,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         if (comparePhaseNum(pmNum, phaseNum, directoryContext) > 0
                             && (roadmapNextNum === null || comparePhaseNum(pmNum, roadmapNextNum, directoryContext) < 0)) {
                             roadmapNextNum = pmNum;
-                            roadmapNextName = pmName
-                                .replace(/\(INSERTED\)/i, '')
-                                .trim()
+                            roadmapNextName = (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(pmName)
                                 .toLowerCase()
                                 .replace(/\s+/g, '-');
                         }
@@ -6636,7 +6742,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // Without it, this lowest-outstanding override was blind to dash-grammar
                     // rows and could not correct an out-of-order completion on the same
                     // mixed-grammar roadmaps that broke stage 2.
-                    const cbPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+(${phaseScanTokenSource(directoryContext)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*[—–:\\-]\\s*([^\\n*]+)`, 'gi', { state: 'captured' });
+                    const cbPattern = (0, phase_entry_grammar_cjs_1.phaseEntryRegExp)(`Phase\\s+(${phaseScanTokenSource(directoryContext, phaseConvention)})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*[—–:\\-]\\s*([^\\n*]+)`, 'gi', { state: 'captured' });
                     let cbm;
                     let lowestOutstanding = null;
                     while ((cbm = cbPattern.exec(milestoneScope)) !== null) {
@@ -6652,7 +6758,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                             if (lowestOutstanding === null || comparePhaseNum(cbm[2], lowestOutstanding.num, directoryContext) < 0) {
                                 lowestOutstanding = {
                                     num: cbm[2],
-                                    name: cbm[3].replace(/\(INSERTED\)/i, '').trim().toLowerCase().replace(/\s+/g, '-'),
+                                    name: (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(cbm[3]).toLowerCase().replace(/\s+/g, '-'),
                                 };
                             }
                         }
@@ -6685,7 +6791,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                 // pin would all rewind it. A first-time completion (box unchecked, or
                 // STATE not past N, #2028 out-of-order) still transitions.
                 const stateAlreadyPast = phaseWasAlreadyComplete
-                    && (0, state_transition_cjs_1.isStatePastPhase)(originalStateContent, phaseNum, statePath);
+                    && (0, state_transition_cjs_1.isStatePastPhase)(originalStateContent, phaseNum, statePath, phaseConvention);
                 let stateContent = originalStateContent;
                 // ADR-1769 Phase 3: the STATE.md field-update policy (Current Phase
                 // shape/name, Status, Current Plan, Last Activity + Description, and
@@ -6715,7 +6821,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         const nextInfo = findPhaseInternal(cwd, nextPhaseNum, undefined, directoryContext);
                         if (nextInfo && nextInfo.found && nextInfo.directory) {
                             const { value } = (0, phase_status_cjs_1.phaseStatus)(node_path_1.default.join(cwd, nextInfo.directory), {
-                                convention: resolvePhaseIdConvention(cwd),
+                                convention: phaseConvention,
                             });
                             nextPhaseDisk = { status: value.status, planCount: value.planCount, summaryCount: value.summaryCount };
                         }
@@ -6882,22 +6988,39 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
         error(`Phase ${phaseNum} verification is incomplete: ${verificationBlocked.next_action}${nextStep}${indeterminateNote}`, ERROR_REASON.PHASE_VERIFICATION_INCOMPLETE, { verification_stale_check_indeterminate: staleCheckIndeterminate });
     }
     let autoPruned = false;
+    // #5831: a failed auto-prune stays non-fatal (exit code and completion are
+    // unchanged), but is reported instead of swallowed — prune now fails loudly
+    // when it cannot write the archive, and that must reach the user.
+    let autoPruneError = null;
     try {
         const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
-        if (node_fs_1.default.existsSync(configPath)) {
-            const rawConfig = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        // Bounded read (#5759): null is an absent file; a FIFO/device/oversized one throws to the
+        // best-effort catch below.
+        const rawConfigText = configLoaderMod.readConfigFileBounded(configPath);
+        if (rawConfigText !== null) {
+            const rawConfig = JSON.parse(rawConfigText);
             const workflow = rawConfig['workflow'];
             const autoPruneEnabled = workflow && workflow['auto_prune_state'] === true;
             if (autoPruneEnabled && node_fs_1.default.existsSync(statePath)) {
                 // Non-hoisted: load-order matters (stateMod must be fully resolved first).
                 const { cmdStatePrune } = stateMod;
-                cmdStatePrune(cwd, { keepRecent: '3', dryRun: false, silent: true }, true);
-                autoPruned = true;
+                try {
+                    const pruneResult = cmdStatePrune(cwd, { keepRecent: '3', dryRun: false, silent: true }, true);
+                    // Only a prune that moved entries counts: a no-op prune leaves auto_pruned false.
+                    autoPruned = pruneResult.pruned === true;
+                }
+                catch (err) {
+                    // Best-effort: completion proceeds; STATE.md and STATE-ARCHIVE.md are as
+                    // the failed prune left them (it never loses entries).
+                    autoPruneError = err instanceof Error ? err.message : String(err);
+                    warnings.push(`auto-prune of STATE.md failed (phase completion is unaffected; run \`state prune\` to retry): ${autoPruneError}`);
+                }
             }
         }
     }
     catch {
-        /* intentionally empty — auto-prune is best-effort */
+        // Best-effort: an unreadable or invalid config.json means auto-prune is not
+        // enabled; completion proceeds silently.
     }
     const result = {
         completed_phase: phaseNum,
@@ -6911,6 +7034,8 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
         state_updated: stateUpdated,
         requirements_updated: requirementsUpdated,
         auto_pruned: autoPruned,
+        // #5831: ADDITIVE — present only when auto-prune threw.
+        ...(autoPruneError !== null ? { auto_prune_error: autoPruneError } : {}),
         warnings,
         has_warnings: warnings.length > 0,
         // ADDITIVE, never a change to `warnings[]`'s element shape — that array is

package/gsd-core/bin/lib/plan-dependency-graph.cjs

@@ -85,10 +85,11 @@ function isHaltedStatus(status) {
  * @param summaryPath - absolute or relative path to a `*-SUMMARY.md` file.
  */
 function isSummaryFileHalted(summaryPath) {
+    const content = readSummaryFrontmatterPrefix(summaryPath);
+    if (content === null)
+        return false;
     try {
-        const content = node_fs_1.default.readFileSync(summaryPath, 'utf-8');
-        const fm = extractFrontmatter(content, summaryPath);
-        return isHaltedStatus(fm['status']);
+        return isHaltedStatus(extractFrontmatter(content, summaryPath)['status']);
     }
     catch {
         return false;
@@ -140,6 +141,46 @@ function isBlockedStatus(status) {
 // kept here because this predicate's primary caller (scanPhasePlans) loops
 // over every phase directory on hot paths (state sync, roadmap progress).
 const SUMMARY_FRONTMATTER_READ_CAP = 64 * 1024;
+/**
+ * #5789: the ONE reader behind both SUMMARY status predicates
+ * (`isSummaryFileHalted`, `isSummaryFileBlocked`), so they agree on which
+ * inputs are read. Opens O_NONBLOCK (never blocks on a FIFO; the flag is
+ * undefined on Windows, where FIFOs do not exist), decides the type on the
+ * opened fd (no stat-then-open swap window), refuses anything but a regular
+ * file (FIFO, /dev/zero via a symlink, socket, directory), and reads at most
+ * SUMMARY_FRONTMATTER_READ_CAP bytes from offset 0. Symlinks to regular files
+ * are still followed. Returns null on any error or non-regular input.
+ */
+function readSummaryFrontmatterPrefix(summaryPath) {
+    let fd;
+    try {
+        fd = node_fs_1.default.openSync(summaryPath, node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NONBLOCK || 0));
+        if (!node_fs_1.default.fstatSync(fd).isFile())
+            return null;
+        const buf = Buffer.allocUnsafe(SUMMARY_FRONTMATTER_READ_CAP);
+        let total = 0;
+        while (total < SUMMARY_FRONTMATTER_READ_CAP) {
+            const n = node_fs_1.default.readSync(fd, buf, total, SUMMARY_FRONTMATTER_READ_CAP - total, total);
+            if (n === 0)
+                break;
+            total += n;
+        }
+        return buf.toString('utf8', 0, total);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                node_fs_1.default.closeSync(fd);
+            }
+            catch {
+                // close failure on a read-only fd is not actionable
+            }
+        }
+    }
+}
 /**
  * #3345: read a SUMMARY file's frontmatter `status` (bounded-prefix read) and
  * report whether it declares `status: blocked`. Returns false — never throws —
@@ -153,27 +194,9 @@ const SUMMARY_FRONTMATTER_READ_CAP = 64 * 1024;
  * re-diverge on the blocked rule.
  */
 function isSummaryFileBlocked(summaryPath) {
-    let content;
-    try {
-        const st = node_fs_1.default.statSync(summaryPath); // follows symlinks → resolves to the target's real type
-        if (!st.isFile())
-            return false;
-        const length = Math.min(st.size, SUMMARY_FRONTMATTER_READ_CAP);
-        if (length === 0)
-            return false;
-        const fd = node_fs_1.default.openSync(summaryPath, 'r');
-        try {
-            const buf = Buffer.allocUnsafe(length);
-            const bytesRead = node_fs_1.default.readSync(fd, buf, 0, length, 0);
-            content = buf.toString('utf8', 0, bytesRead);
-        }
-        finally {
-            node_fs_1.default.closeSync(fd);
-        }
-    }
-    catch {
+    const content = readSummaryFrontmatterPrefix(summaryPath);
+    if (content === null || content.length === 0)
         return false;
-    }
     return isBlockedStatus(extractFrontmatter(content, summaryPath)['status']);
 }
 /**