@opengsd/gsd-core 1.20.1 → 1.21.0

package/gsd-core/bin/lib/markdown-table.cjs

@@ -26,6 +26,7 @@ exports.appendQuickTaskRow = appendQuickTaskRow;
 exports.migrateQuickTasksTable = migrateQuickTasksTable;
 exports.resetQuickTaskRows = resetQuickTaskRows;
 exports.updateTraceabilityCell = updateTraceabilityCell;
+exports.traceabilityRowExists = traceabilityRowExists;
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // ─── Schema registry ──────────────────────────────────────────────────────────
 /**
@@ -979,6 +980,8 @@ function resetQuickTaskRows(stateContent) {
     const content = (0, markdown_sectionizer_cjs_1.replaceSection)(stateContent, section, newBody);
     return { ok: true, value: { content, cleared, variant: match.label } };
 }
+/** The one Traceability heading rule shared by the write and the existence read. */
+const TRACEABILITY_HEADING_RE = /^Traceability(?:[ \t]+Status)?\b/i;
 /**
  * `updateTableCell` scoped to REQUIREMENTS.md's `## Traceability` (or
  * `## Traceability Status`) section (#2245 F1, #5762): `updateTableCell` binds
@@ -991,7 +994,7 @@ function resetQuickTaskRows(stateContent) {
  */
 function updateTraceabilityCell(text, match, column, newValue) {
     const headings = (0, markdown_sectionizer_cjs_1.tokenizeHeadings)(text);
-    const index = headings.findIndex((h) => h.level === 2 && /^Traceability(?:[ \t]+Status)?\b/i.test(h.text));
+    const index = headings.findIndex((h) => h.level === 2 && TRACEABILITY_HEADING_RE.test(h.text));
     if (index === -1)
         return updateTableCell(text, match, column, newValue);
     let result = { ok: false, reason: 'no matching row' };
@@ -1001,5 +1004,40 @@ function updateTraceabilityCell(text, match, column, newValue) {
     });
     return result.ok ? { ok: true, value: edited } : result;
 }
+/**
+ * Row-existence READ for REQUIREMENTS.md's Traceability section (#5844): true
+ * when any table row in the section has `id` (case-insensitive) as its first
+ * cell, whatever the table's columns. `updateTraceabilityCell(..., 'Status', …)`
+ * answers "is there a row" only for tables that HAVE a Status column; this
+ * answers it for every table. Scoping mirrors `updateTraceabilityCell`: the
+ * same heading rule, and only the FIRST table of the scoped text (with no
+ * Traceability heading that is the first table in the file), so a table
+ * elsewhere whose first cell equals the ID is not a Traceability row.
+ */
+function traceabilityRowExists(text, id) {
+    const headings = (0, markdown_sectionizer_cjs_1.tokenizeHeadings)(text);
+    const index = headings.findIndex((h) => h.level === 2 && TRACEABILITY_HEADING_RE.test(h.text));
+    let scoped = text;
+    if (index !== -1) {
+        (0, markdown_sectionizer_cjs_1.editHeadingSlice)(text, (0, markdown_sectionizer_cjs_1.headingSliceRange)(text, headings, index, 2), (slice) => {
+            scoped = slice;
+            return slice;
+        });
+    }
+    const wanted = id.trim().toLowerCase();
+    let inTable = false;
+    for (const line of scoped.split(/\r?\n/)) {
+        if (!line.trim().startsWith('|')) {
+            if (inTable)
+                return false;
+            continue;
+        }
+        inTable = true;
+        const cells = splitTableRow(line);
+        if (cells.length > 0 && cells[0].trim().toLowerCase() === wanted)
+            return true;
+    }
+    return false;
+}
 // Consumers: require('../gsd-core/bin/lib/markdown-table.cjs')
 // Named CJS exports are the canonical surface (ADR-457 .cts → .cjs build-at-publish).

package/gsd-core/bin/lib/milestone.cjs

@@ -43,7 +43,7 @@ const pattern_cjs_1 = require("./pattern.cjs");
 const milestone_release_map_cjs_1 = require("./milestone-release-map.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
-const { getMilestonePhaseFilter, extractCurrentMilestone, getMilestoneInfo, sliceMilestoneWindow, } = roadmapParserMod;
+const { getMilestonePhaseFilter, extractCurrentMilestone, getMilestoneInfo, sliceMilestoneWindow, classifyMilestoneScalar, readStateMilestoneScalar, sameMilestoneVersion, } = roadmapParserMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningScopeMod = require("./planning-scope.cjs");
 const { SCOPE } = planningScopeMod;
@@ -225,7 +225,9 @@ function cmdRequirementsMarkComplete(cwd, reqIdsRaw, raw) {
         // Surface traceability drift: checkbox reconciled (this run or before) but the
         // table has no row for this ID. This is what makes a partial reconcile
         // distinguishable from a full one (#2140).
-        if (hasTable && doneCheckbox && !hasRow) {
+        // #5844: a row in a table with no Status column is still a row; only the
+        // Status write is impossible there, so existence is read directly.
+        if (hasTable && doneCheckbox && !hasRow && !(0, markdown_table_cjs_1.traceabilityRowExists)(reqContent, reqId)) {
             tableUnmatched.push(reqId);
         }
     }
@@ -603,15 +605,15 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
             try {
                 const stateRaw = node_fs_1.default.existsSync(statePath) ? node_fs_1.default.readFileSync(statePath, 'utf-8') : null;
                 if (stateRaw) {
-                    const milestoneMatch = stateRaw.match(/^milestone:\s*(.+)/m);
-                    if (milestoneMatch)
-                        stateVersion = milestoneMatch[1].trim();
+                    // One owner for the STATE `milestone:` scalar (#5726): quoted, null and
+                    // empty values and a body `milestone:` line are not drift.
+                    stateVersion = classifyMilestoneScalar(readStateMilestoneScalar(stateRaw)).version;
                 }
             }
             catch {
                 /* skip — stateVersion stays null, scan still runs */
             }
-            if (stateVersion !== null && stateVersion !== version) {
+            if (stateVersion !== null && !sameMilestoneVersion(stateVersion, version)) {
                 // #2946: emit a WARNING so the suspicious STATE mismatch is visible
                 // rather than silently disarming the guard. Plain-text diagnostic on
                 // stderr, matching the existing [gsd-tools] WARNING convention

package/gsd-core/bin/lib/model-resolver.cjs

@@ -11,7 +11,7 @@
  * epic #1267; callers import resolvers from model-resolver.cjs directly.
  *
  * Dependencies (leaf modules only):
- *   - node:fs / node:path (read the per-install .gsd-runtime marker + project config for the #2297 omit gate)
+ *   - node:path (project config path for the #2297 omit gate; read via config-loader's bounded reader, #5759)
  *   - ./runtime-name-policy.cjs (resolveRuntimeNameFromCandidates — canonicalize the active runtime)
  *   - ./planning-workspace.cjs  (planningDir — workstream/project-aware project-config path)
  *   - ./config-loader.cjs    (loadConfig)
@@ -25,14 +25,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderModule = require("./config-loader.cjs");
-const { loadConfig } = configLoaderModule;
+const { loadConfig, readConfigFileBounded } = configLoaderModule;
 // ─── Configuration Module (for CANONICAL_CONFIG_DEFAULTS used by effort/fast_mode resolvers) ─
 const configuration_cjs_1 = require("./configuration.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelProfiles = require("./model-profiles.cjs");
 const { MODEL_PROFILES, AGENT_TO_PHASE_TYPE, AGENT_DEFAULT_TIERS, VALID_AGENT_TIERS, nextTier } = modelProfiles;
 const model_catalog_cjs_1 = require("./model-catalog.cjs");
-const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const runtime_name_policy_cjs_1 = require("./runtime-name-policy.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
@@ -87,7 +86,12 @@ function projectExplicitlySetsOmit(cwd) {
     const layers = wsDir === rootDir ? [rootDir] : [wsDir, rootDir]; // workstream > root
     for (const dir of layers) {
         try {
-            const parsed = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, 'config.json'), 'utf8'));
+            // Same bounded regular-file reader as the loader (#5759): a FIFO/device/oversized
+            // layer throws instead of blocking, and an absent layer returns null.
+            const raw = readConfigFileBounded(node_path_1.default.join(dir, 'config.json'));
+            if (raw === null)
+                continue;
+            const parsed = JSON.parse(raw);
             const value = parsed?.['resolve_model_ids'];
             // First layer that sets the key wins (matches loadConfig's deep-merge
             // precedence). A layer that omits the key falls through to the next.

package/gsd-core/bin/lib/phase-entry-grammar.cjs

@@ -32,6 +32,7 @@ exports.phaseEntryRegExp = phaseEntryRegExp;
 exports.phaseEntrySplitRegExp = phaseEntrySplitRegExp;
 exports.isPhaseEntryChecked = isPhaseEntryChecked;
 exports.isBoxCharChecked = isBoxCharChecked;
+exports.stripInsertedMarker = stripInsertedMarker;
 const MARKER_SRC = '[-*]';
 // A list item has 1 to 4 spaces or tabs after its marker (CommonMark: none is not a list item,
 // five or more makes the rest an indented code block), so `-[ ] **Phase 1**` is not an entry.
@@ -117,3 +118,16 @@ function isPhaseEntryChecked(entryText) {
 function isBoxCharChecked(boxChar) {
     return boxChar.toLowerCase() === 'x';
 }
+/**
+ * #5824: `phase insert` writes `(INSERTED)` into the heading text as
+ * bookkeeping; it is not part of the phase's name. The single place that
+ * removes it: only a TRAILING `(INSERTED)` (case-insensitive) is dropped, then
+ * a trim — `phase insert` always appends it last, and a `(INSERTED)` inside the
+ * user's own text is kept. A name that is only the marker is returned as
+ * written rather than reduced to an empty name. Every phase-name reader goes
+ * through here so none can drift from the others.
+ */
+function stripInsertedMarker(name) {
+    const stripped = name.replace(/\s*\(INSERTED\)\s*$/i, '').trim();
+    return stripped === '' ? name.trim() : stripped;
+}

package/gsd-core/bin/lib/phase-locator.cjs

@@ -47,7 +47,7 @@ const { planningDir, planningRoot, resolveEnvWorkstream, resolvePhaseIdConventio
 // Naming readers and writers share the loader's scoped-key precedence and defaults.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderModule = require("./config-loader.cjs");
-const { CONFIG_DEFAULTS, _deepMergeConfig, _getConfigValue, loadConfig } = configLoaderModule;
+const { CONFIG_DEFAULTS, _deepMergeConfig, _getConfigValue, loadConfig, readConfigFileBounded } = configLoaderModule;
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatterModule = require("./frontmatter.cjs");
@@ -253,7 +253,12 @@ function phaseDirectoryOptions(cwd, config, roadmap, ws) {
     if (naming === undefined) {
         const readConfig = (file) => {
             try {
-                const value = JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
+                // Bounded read (#5759): null is an absent file (no configError); a FIFO/device/oversized
+                // file throws and is reported through configError like any other unreadable config.
+                const raw = readConfigFileBounded(file);
+                if (raw === null)
+                    return null;
+                const value = JSON.parse(raw);
                 if (value && typeof value === 'object' && !Array.isArray(value))
                     return value;
                 configError = { path: file, message: 'configuration must be a JSON object' };
@@ -305,7 +310,7 @@ function phaseDirectoryOptions(cwd, config, roadmap, ws) {
                 // Windows may omit these flags: lstat/fstat still require a regular file,
                 // but the open is not atomically no-follow there. Adopt Windows no-follow
                 // flags here if Node exposes them; no caller should weaken these checks.
-                identityFd = node_fs_1.default.openSync(markerPath, node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK | node_fs_1.default.constants.O_NOFOLLOW);
+                identityFd = node_fs_1.default.openSync(markerPath, node_fs_1.default.constants.O_RDONLY | node_fs_1.default.constants.O_NONBLOCK | node_fs_1.default.constants.O_NOFOLLOW | (node_fs_1.default.constants.O_NOCTTY ?? 0));
                 const opened = node_fs_1.default.fstatSync(identityFd);
                 if (!opened.isFile() || opened.size > 1024)
                     continue;

package/gsd-core/bin/lib/phase.cjs

@@ -51,6 +51,7 @@ const phaseIdDisplayMod = require("./phase-id-display.cjs");
 const { milestoneToken, phaseToken } = phaseIdDisplayMod;
 const phase_entry_grammar_cjs_1 = require("./phase-entry-grammar.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
+const markdown_table_cjs_1 = require("./markdown-table.cjs");
 const gate_exit_cjs_1 = require("./gate-exit.cjs");
 const gate_verdict_cjs_1 = require("./gate-verdict.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
@@ -61,7 +62,7 @@ const planningScopeMod = require("./planning-scope.cjs");
 const { SCOPE } = planningScopeMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- roadmap-parser.cjs is an export= CommonJS module
 const roadmapParserMod = require("./roadmap-parser.cjs");
-const { stripShippedMilestones, extractCurrentMilestone, currentMilestoneRawRanges, withPhaseSection, editCurrentMilestone, findMilestoneScopeHeadingLines, getMilestoneInfo, 
+const { stripShippedMilestones, extractCurrentMilestone, extractCurrentMilestoneScoped, currentMilestoneRawRanges, withPhaseSection, editCurrentMilestone, findMilestoneScopeHeadingLines, getMilestoneInfo, 
 // #5679: the STATE.md milestone read getMilestoneInfo itself uses, and the
 // archive-aware owner of a ROADMAP offset.
 readStateMilestoneScalar, classifyMilestoneScalar, milestoneVersionAtOffset, blankCodeAndComments, scanMilestonePhaseIds, 
@@ -97,7 +98,7 @@ const planning_document_cjs_1 = require("./planning-document.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const clock_cjs_1 = require("./clock.cjs");
 const state_transition_cjs_1 = require("./state-transition.cjs");
-const markdown_table_cjs_1 = require("./markdown-table.cjs");
+const markdown_table_cjs_2 = require("./markdown-table.cjs");
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const security_cjs_1 = require("./security.cjs");
 // #5060: the Phase Status Module owns the ROADMAP Status-cell token vocabulary.
@@ -1250,7 +1251,7 @@ function recordNewPhase(raw, cwd, id, description, after, label) {
         if (findPhaseTableHeader(scoped) === -1)
             return scoped;
         const cell = { Phase: `${id}. ${description}`, 'Plans Complete': '0/0', Status: 'Not started' };
-        const r = (0, markdown_table_cjs_1.insertTableRow)(scoped, (col) => cell[col]);
+        const r = (0, markdown_table_cjs_2.insertTableRow)(scoped, (col) => cell[col]);
         if (!r.ok)
             return scoped;
         wrote = true;
@@ -1641,6 +1642,54 @@ function assertBracketGeneratedIdentity(command, config, customId) {
             'Custom naming precedence under the bracket convention lands with #5067.');
     }
 }
+const STATE_MILESTONE_ECHO_LIMIT = 80;
+/**
+ * #5726: STATE.md's `milestone:` value is untrusted text. Cap it at
+ * `STATE_MILESTONE_ECHO_LIMIT` characters (ellipsis past the cap), then quote it
+ * with `JSON.stringify` (the `phase.cts` precedent for echoed user text), which
+ * escapes ESC/BEL/newlines; the characters JSON leaves raw but a terminal acts on
+ * are escaped too: DEL and C1 controls, zero-width and direction marks
+ * (U+200B-U+200F), line/paragraph separators and bidi embeddings/overrides
+ * (U+2028-U+202E), the invisible-format block (U+2060-U+206F, incl. bidi
+ * isolates), soft hyphen (U+00AD), Arabic letter mark (U+061C), Mongolian
+ * vowel separator (U+180E), interlinear annotations (U+FFF9-U+FFFB) and the
+ * BOM (U+FEFF).
+ */
+function echoStateMilestone(value) {
+    const chars = Array.from(value);
+    const capped = chars.length > STATE_MILESTONE_ECHO_LIMIT
+        ? `${chars.slice(0, STATE_MILESTONE_ECHO_LIMIT).join('')}…`
+        : value;
+    return JSON.stringify(capped).replace(/[\u007f-\u009f\u{ad}\u{61c}\u{180e}\u{200b}-\u{200f}\u{2028}-\u{202e}\u{2060}-\u{206f}\u{feff}\u{fff9}-\u{fffb}]/gu, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+/**
+ * #5726: the current-milestone window for a verb that WRITES to the ROADMAP.
+ * When STATE.md names a milestone that has no heading in a ROADMAP carrying
+ * versioned milestones, the window owner falls back to the whole unshipped
+ * roadmap (scope UNSCOPED, `unresolvedMilestone` set), and number allocation,
+ * the `Depends on` line and the insert target would run over every milestone.
+ * ADR-3180: that is a non-answer, refused where it is destructive. Refuses
+ * before any write, naming the milestone; every other scope (a real heading,
+ * a free-form legacy ROADMAP, no milestone field) returns the window unchanged.
+ * Read-only readers keep calling `extractCurrentMilestone` and keep degrading.
+ */
+function currentMilestoneWindowOrRefuse(rawContent, cwd, command) {
+    const { value, unresolvedMilestone, shippedMilestone } = extractCurrentMilestoneScoped(rawContent, cwd);
+    if (shippedMilestone) {
+        error(`${command}: STATE.md names milestone ${echoStateMilestone(shippedMilestone)}, which ROADMAP.md marks as already shipped, `
+            + 'so the current milestone window is a closed one. Refusing to number the phase or link its dependencies '
+            + 'against a shipped milestone. Start the next milestone (or correct the milestone field in STATE.md), then retry. '
+            + 'If the heading is not shipped and its title merely contains a status word (such as "Failed Payment Recovery"), '
+            + 'rename the milestone, or add an active marker to the heading, for example \u{1f6a7} or "(in progress)".');
+    }
+    if (unresolvedMilestone) {
+        error(`${command}: STATE.md names milestone ${echoStateMilestone(unresolvedMilestone)}, but ROADMAP.md has no milestone heading for it, `
+            + 'so the current milestone window cannot be resolved. Refusing to use the whole roadmap, which would number '
+            + 'the phase and link its dependencies against other milestones. Add the milestone heading to ROADMAP.md '
+            + 'or correct the milestone field in STATE.md, then retry.');
+    }
+    return value;
+}
 /**
  * #4304: refuse a bracket `phase add` / `add-batch` whose located milestone
  * window is a decoy. A non-milestone heading carrying the active version
@@ -1712,9 +1761,9 @@ function cmdPhaseAdd(cwd, description, raw, customId) {
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, config) : null;
     const { newPhaseId, dirName, roadmapEntry } = withPlanningLock(cwd, () => {
         const rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase add');
         if (bracketContext)
             assertBracketAddWindowLocated(rawContent, cwd, bracketContext, 'phase add');
-        const content = extractCurrentMilestone(rawContent, cwd);
         let _newPhaseId;
         let _dirName = '';
         if (bracketContext) {
@@ -1821,9 +1870,9 @@ function cmdPhaseAddBatch(cwd, descriptions, raw) {
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, config) : null;
     const results = withPlanningLock(cwd, () => {
         let rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase add-batch');
         if (bracketContext)
             assertBracketAddWindowLocated(rawContent, cwd, bracketContext, 'phase add-batch');
-        const content = extractCurrentMilestone(rawContent, cwd);
         let maxPhase = 0;
         if (bracketContext) {
             const used = collectBracketPhaseNumbers(content, node_path_1.default.join(planningDir(cwd), 'phases'), bracketContext);
@@ -2236,7 +2285,7 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw, allocation = 'nested'
     const bracketContext = convention === 'bracket' ? bracketWriteContext(cwd, insertConfig) : null;
     const { decimalPhase, dirName, roadmapEntry } = withPlanningLock(cwd, () => {
         const rawContent = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
-        const content = extractCurrentMilestone(rawContent, cwd);
+        const content = currentMilestoneWindowOrRefuse(rawContent, cwd, 'phase insert');
         // #4304: canonicalize a bracket argument
         // through the SAME adapter `phase remove` uses
         // (canonicalizeBracketPhaseArgument) instead of the legacy
@@ -2837,7 +2886,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
             return parseInt(leadingMatch[1], 10) === removedInt;
         };
         content = (0, roadmap_progress_cjs_1.editRoadmapProgress)(content, (progressSection) => {
-            const deleteResult = (0, markdown_table_cjs_1.deleteTableRow)(progressSection, matchRemovedProgressRow);
+            const deleteResult = (0, markdown_table_cjs_2.deleteTableRow)(progressSection, matchRemovedProgressRow);
             return deleteResult.ok ? deleteResult.value : progressSection;
         }, { headingless: 'skip' });
         if (!isDecimal && !customTarget) {
@@ -2917,7 +2966,7 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
                 let matchedRowIndex = null;
                 for (;;) {
                     matchedRowIndex = null;
-                    const cellResult = (0, markdown_table_cjs_1.updateTableCell)(ordinalSection, (row, index) => {
+                    const cellResult = (0, markdown_table_cjs_2.updateTableCell)(ordinalSection, (row, index) => {
                         if (processedOrdinalRows.has(index))
                             return false;
                         const m = phaseCellShapeRe.exec(row['Phase'] ?? '');
@@ -2938,11 +2987,11 @@ function updateRoadmapAfterPhaseRemoval(roadmapPath, targetPhase, isDecimal, rem
                         const newContent = `${decremented}${m[2]}${current.slice(m[0].length)}`;
                         const targetLine = matchedRowIndex === null ? null : findDataRowLine(ordinalSection, matchedRowIndex);
                         const padMatch = targetLine
-                            ? new RegExp(`^[ \\t]*\\|(\\s*)${(0, pattern_cjs_1.escapeRegex)((0, markdown_table_cjs_1.escapeCell)(current))}(\\s*)\\|`).exec(targetLine)
+                            ? new RegExp(`^[ \\t]*\\|(\\s*)${(0, pattern_cjs_1.escapeRegex)((0, markdown_table_cjs_2.escapeCell)(current))}(\\s*)\\|`).exec(targetLine)
                             : null;
                         const leadPad = padMatch ? padMatch[1] : ' ';
                         const trailPad = padMatch ? padMatch[2] : ' ';
-                        return `${leadPad}${(0, markdown_table_cjs_1.escapeCell)(newContent)}${trailPad}`;
+                        return `${leadPad}${(0, markdown_table_cjs_2.escapeCell)(newContent)}${trailPad}`;
                     });
                     if (!cellResult.ok)
                         break;
@@ -3532,7 +3581,7 @@ function classifyBracketOwnedLine(line) {
     if (checklistId)
         return { kind: 'checklist', id: checklistId };
     if (/^[ \t]*\|/.test(line)) {
-        const firstCell = (0, markdown_table_cjs_1.splitTableRow)(line)[0]?.replace(/^\*\*(.*)\*\*$/, '$1') ?? '';
+        const firstCell = (0, markdown_table_cjs_2.splitTableRow)(line)[0]?.replace(/^\*\*(.*)\*\*$/, '$1') ?? '';
         const progressId = phaseIdFromOwnedLineMatch(BRACKET_CELL_ID_RE.exec(firstCell));
         if (progressId)
             return { kind: 'progress', id: progressId };
@@ -4894,7 +4943,7 @@ function phaseDisplayNameFromRoadmap(roadmapContent, phaseNum) {
     const heading = matchedHeading.text.match(headingPattern);
     if (!heading)
         return null;
-    const name = heading[1].replace(/\(INSERTED\)/i, '').trim();
+    const name = (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(heading[1]);
     return name || null;
 }
 function phaseDisplayNameFromSlug(slug) {
@@ -6073,12 +6122,12 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // (`editProgressTableSlice` -> `editRoadmapProgress`), the same one `roadmap update-plan-progress` uses.
                     s = editProgressTableSlice(s, (scoped) => {
                         let text = scoped;
-                        const plansResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Plans Complete', ` ${summaryCount}/${planCount} `);
+                        const plansResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Plans Complete', ` ${summaryCount}/${planCount} `);
                         if (plansResult.ok)
                             text = plansResult.value;
                         // #5165: a Status cell that already reads Complete is left untouched —
                         // re-padding it rewrote a cell the re-run had no business editing.
-                        const statusResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Status', (current) => (0, phase_status_cjs_1.parseRoadmapStatusCell)(current) === phase_status_cjs_1.WIRE_STATUS.COMPLETE
+                        const statusResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Status', (current) => (0, phase_status_cjs_1.parseRoadmapStatusCell)(current) === phase_status_cjs_1.WIRE_STATUS.COMPLETE
                             ? current
                             : ` ${(0, phase_status_cjs_1.toRoadmapStatusCell)(phase_status_cjs_1.PHASE_STATUS.COMPLETE).padEnd(11)} `);
                         if (statusResult.ok)
@@ -6090,7 +6139,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         // findTableWithColumns (which requires the WHOLE table to parse —
                         // a ragged SIBLING row elsewhere used to silently no-op this
                         // row's date stamp too).
-                        const completedResult = (0, markdown_table_cjs_1.updateTableCell)(text, rowMatch, 'Completed', (current) => dateShape.test(current.trim()) ? current : ` ${today} `);
+                        const completedResult = (0, markdown_table_cjs_2.updateTableCell)(text, rowMatch, 'Completed', (current) => dateShape.test(current.trim()) ? current : ` ${today} `);
                         if (completedResult.ok)
                             text = completedResult.value;
                         return text;
@@ -6228,7 +6277,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                             // checkbox rollback below can distinguish "row existed and accepted" from
                             // "row existed and rejected".
                             let tableHit = false;
-                            const reqUpdate = (0, markdown_table_cjs_1.updateTraceabilityCell)(reqContent, reqRowMatch, 'Status', (current) => {
+                            const reqUpdate = (0, markdown_table_cjs_2.updateTraceabilityCell)(reqContent, reqRowMatch, 'Status', (current) => {
                                 // #2788: accept `Gaps Found` too so a phase stranded by revert-phase (the
                                 // gaps_found response) can complete without hand-editing the table.
                                 if (/^(?:pending|in progress|gaps found)$/i.test(current.trim())) {
@@ -6405,9 +6454,9 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // which section (deferred or not) it lives under.
                     const reqIsRegisteredAnywhere = (id) => {
                         const reqEscaped = (0, pattern_cjs_1.escapeRegex)(id);
-                        // Surface 1 — checkbox, EITHER state (`[ ]` or `[x]`), case-
-                        // insensitive: existence check, not the write's space-only match.
-                        if (new RegExp(`-\\s*\\[[ xX]\\]\\s*\\*\\*${reqEscaped}\\*\\*`, 'i').test(reqContent)) {
+                        // Surface 1 — checkbox, ANY single mark (`[ ]`, `[x]`, `[~]`, …; #5844),
+                        // case-insensitive: existence check, not the write's space-only match.
+                        if (new RegExp(`-\\s*\\[[^\\]\\r\\n]\\]\\s*\\*\\*${reqEscaped}\\*\\*`, 'i').test(reqContent)) {
                             return true;
                         }
                         // Surface 2 — Traceability row exists at all (any Status value),
@@ -6415,7 +6464,10 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         // technique milestone.cts's `hasRow` uses (:210-214): a case-
                         // insensitive first-cell match, regardless of current Status.
                         const rowProbeMatch = (row) => (Object.values(row)[0] ?? '').trim().toLowerCase() === id.toLowerCase();
-                        return (0, markdown_table_cjs_1.updateTraceabilityCell)(reqContent, rowProbeMatch, 'Status', (current) => current).ok;
+                        // #5844: a table with no Status column fails the probe above with
+                        // `unknown column`, so row existence is also read directly.
+                        return (0, markdown_table_cjs_2.updateTraceabilityCell)(reqContent, rowProbeMatch, 'Status', (current) => current).ok
+                            || (0, markdown_table_cjs_1.traceabilityRowExists)(reqContent, id);
                     };
                     const ghostReqIds = citedReqIds.filter((id) => !isPlaceholderReqId(id) && !reqIsRegisteredAnywhere(id));
                     if (ghostReqIds.length > 0) {
@@ -6427,8 +6479,15 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                     // IDs already reported above as ghosts to avoid a duplicate message
                     // for the same root cause.
                     const traceabilityWriteFailures = traceabilityWriteMisses.filter((id) => !ghostReqIds.includes(id));
-                    if (traceabilityWriteFailures.length > 0) {
-                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (no matching row found): ${traceabilityWriteFailures.join(', ')}`);
+                    // #5844: a row that EXISTS but has no Status cell to write is not a
+                    // missing row — name the real cause instead of blaming the row.
+                    const noStatusCellIds = traceabilityWriteFailures.filter((id) => (0, markdown_table_cjs_1.traceabilityRowExists)(reqContent, id));
+                    const noRowIds = traceabilityWriteFailures.filter((id) => !noStatusCellIds.includes(id));
+                    if (noRowIds.length > 0) {
+                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (no matching row found): ${noRowIds.join(', ')}`);
+                    }
+                    if (noStatusCellIds.length > 0) {
+                        warnings.push(`REQUIREMENTS.md: Traceability row write skipped for REQ-ID(s) cited by ROADMAP (row found but the table has no Status column to write): ${noStatusCellIds.join(', ')}`);
                     }
                     writes.push({ filePath: reqPath, before: originalReqContent, after: reqContent });
                     // #2316-3: `requirements_updated` must reflect whether REQUIREMENTS.md
@@ -6619,9 +6678,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         if (comparePhaseNum(pmNum, phaseNum, directoryContext) > 0
                             && (roadmapNextNum === null || comparePhaseNum(pmNum, roadmapNextNum, directoryContext) < 0)) {
                             roadmapNextNum = pmNum;
-                            roadmapNextName = pmName
-                                .replace(/\(INSERTED\)/i, '')
-                                .trim()
+                            roadmapNextName = (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(pmName)
                                 .toLowerCase()
                                 .replace(/\s+/g, '-');
                         }
@@ -6701,7 +6758,7 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                             if (lowestOutstanding === null || comparePhaseNum(cbm[2], lowestOutstanding.num, directoryContext) < 0) {
                                 lowestOutstanding = {
                                     num: cbm[2],
-                                    name: cbm[3].replace(/\(INSERTED\)/i, '').trim().toLowerCase().replace(/\s+/g, '-'),
+                                    name: (0, phase_entry_grammar_cjs_1.stripInsertedMarker)(cbm[3]).toLowerCase().replace(/\s+/g, '-'),
                                 };
                             }
                         }
@@ -6931,22 +6988,39 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
         error(`Phase ${phaseNum} verification is incomplete: ${verificationBlocked.next_action}${nextStep}${indeterminateNote}`, ERROR_REASON.PHASE_VERIFICATION_INCOMPLETE, { verification_stale_check_indeterminate: staleCheckIndeterminate });
     }
     let autoPruned = false;
+    // #5831: a failed auto-prune stays non-fatal (exit code and completion are
+    // unchanged), but is reported instead of swallowed — prune now fails loudly
+    // when it cannot write the archive, and that must reach the user.
+    let autoPruneError = null;
     try {
         const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
-        if (node_fs_1.default.existsSync(configPath)) {
-            const rawConfig = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        // Bounded read (#5759): null is an absent file; a FIFO/device/oversized one throws to the
+        // best-effort catch below.
+        const rawConfigText = configLoaderMod.readConfigFileBounded(configPath);
+        if (rawConfigText !== null) {
+            const rawConfig = JSON.parse(rawConfigText);
             const workflow = rawConfig['workflow'];
             const autoPruneEnabled = workflow && workflow['auto_prune_state'] === true;
             if (autoPruneEnabled && node_fs_1.default.existsSync(statePath)) {
                 // Non-hoisted: load-order matters (stateMod must be fully resolved first).
                 const { cmdStatePrune } = stateMod;
-                cmdStatePrune(cwd, { keepRecent: '3', dryRun: false, silent: true }, true);
-                autoPruned = true;
+                try {
+                    const pruneResult = cmdStatePrune(cwd, { keepRecent: '3', dryRun: false, silent: true }, true);
+                    // Only a prune that moved entries counts: a no-op prune leaves auto_pruned false.
+                    autoPruned = pruneResult.pruned === true;
+                }
+                catch (err) {
+                    // Best-effort: completion proceeds; STATE.md and STATE-ARCHIVE.md are as
+                    // the failed prune left them (it never loses entries).
+                    autoPruneError = err instanceof Error ? err.message : String(err);
+                    warnings.push(`auto-prune of STATE.md failed (phase completion is unaffected; run \`state prune\` to retry): ${autoPruneError}`);
+                }
             }
         }
     }
     catch {
-        /* intentionally empty — auto-prune is best-effort */
+        // Best-effort: an unreadable or invalid config.json means auto-prune is not
+        // enabled; completion proceeds silently.
     }
     const result = {
         completed_phase: phaseNum,
@@ -6960,6 +7034,8 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
         state_updated: stateUpdated,
         requirements_updated: requirementsUpdated,
         auto_pruned: autoPruned,
+        // #5831: ADDITIVE — present only when auto-prune threw.
+        ...(autoPruneError !== null ? { auto_prune_error: autoPruneError } : {}),
         warnings,
         has_warnings: warnings.length > 0,
         // ADDITIVE, never a change to `warnings[]`'s element shape — that array is

package/gsd-core/bin/lib/plan-dependency-graph.cjs

@@ -85,10 +85,11 @@ function isHaltedStatus(status) {
  * @param summaryPath - absolute or relative path to a `*-SUMMARY.md` file.
  */
 function isSummaryFileHalted(summaryPath) {
+    const content = readSummaryFrontmatterPrefix(summaryPath);
+    if (content === null)
+        return false;
     try {
-        const content = node_fs_1.default.readFileSync(summaryPath, 'utf-8');
-        const fm = extractFrontmatter(content, summaryPath);
-        return isHaltedStatus(fm['status']);
+        return isHaltedStatus(extractFrontmatter(content, summaryPath)['status']);
     }
     catch {
         return false;
@@ -140,6 +141,46 @@ function isBlockedStatus(status) {
 // kept here because this predicate's primary caller (scanPhasePlans) loops
 // over every phase directory on hot paths (state sync, roadmap progress).
 const SUMMARY_FRONTMATTER_READ_CAP = 64 * 1024;
+/**
+ * #5789: the ONE reader behind both SUMMARY status predicates
+ * (`isSummaryFileHalted`, `isSummaryFileBlocked`), so they agree on which
+ * inputs are read. Opens O_NONBLOCK (never blocks on a FIFO; the flag is
+ * undefined on Windows, where FIFOs do not exist), decides the type on the
+ * opened fd (no stat-then-open swap window), refuses anything but a regular
+ * file (FIFO, /dev/zero via a symlink, socket, directory), and reads at most
+ * SUMMARY_FRONTMATTER_READ_CAP bytes from offset 0. Symlinks to regular files
+ * are still followed. Returns null on any error or non-regular input.
+ */
+function readSummaryFrontmatterPrefix(summaryPath) {
+    let fd;
+    try {
+        fd = node_fs_1.default.openSync(summaryPath, node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NONBLOCK || 0));
+        if (!node_fs_1.default.fstatSync(fd).isFile())
+            return null;
+        const buf = Buffer.allocUnsafe(SUMMARY_FRONTMATTER_READ_CAP);
+        let total = 0;
+        while (total < SUMMARY_FRONTMATTER_READ_CAP) {
+            const n = node_fs_1.default.readSync(fd, buf, total, SUMMARY_FRONTMATTER_READ_CAP - total, total);
+            if (n === 0)
+                break;
+            total += n;
+        }
+        return buf.toString('utf8', 0, total);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                node_fs_1.default.closeSync(fd);
+            }
+            catch {
+                // close failure on a read-only fd is not actionable
+            }
+        }
+    }
+}
 /**
  * #3345: read a SUMMARY file's frontmatter `status` (bounded-prefix read) and
  * report whether it declares `status: blocked`. Returns false — never throws —
@@ -153,27 +194,9 @@ const SUMMARY_FRONTMATTER_READ_CAP = 64 * 1024;
  * re-diverge on the blocked rule.
  */
 function isSummaryFileBlocked(summaryPath) {
-    let content;
-    try {
-        const st = node_fs_1.default.statSync(summaryPath); // follows symlinks → resolves to the target's real type
-        if (!st.isFile())
-            return false;
-        const length = Math.min(st.size, SUMMARY_FRONTMATTER_READ_CAP);
-        if (length === 0)
-            return false;
-        const fd = node_fs_1.default.openSync(summaryPath, 'r');
-        try {
-            const buf = Buffer.allocUnsafe(length);
-            const bytesRead = node_fs_1.default.readSync(fd, buf, 0, length, 0);
-            content = buf.toString('utf8', 0, bytesRead);
-        }
-        finally {
-            node_fs_1.default.closeSync(fd);
-        }
-    }
-    catch {
+    const content = readSummaryFrontmatterPrefix(summaryPath);
+    if (content === null || content.length === 0)
         return false;
-    }
     return isBlockedStatus(extractFrontmatter(content, summaryPath)['status']);
 }
 /**