@opengsd/gsd-core 1.7.0-rc.6 → 1.7.0

package/gsd-core/bin/lib/runtime-hooks-surface.cjs

@@ -267,7 +267,7 @@ function normalizeNodePath(execPath, opts) {
         return execPath;
     const env = (opts && opts.env) || process.env;
     const existsSync = (opts && opts.existsSync) || node_fs_1.default.existsSync;
-    const normalizedForMatch = execPath.replace(/\\/g, '/');
+    const normalizedForMatch = shellCmdProjection.posixNormalize(execPath);
     if (/\/fnm_multishells\/[0-9]+_[0-9]+\/node(\.exe)?$/i.test(normalizedForMatch)) {
         const candidates = [];
         if (env.FNM_DIR) {
@@ -283,11 +283,16 @@ function normalizeNodePath(execPath, opts) {
         }
         return execPath;
     }
-    if (/^\/usr\/local\/Cellar\/node(@\d+)?\/[^/]+\/bin\/node(\.exe)?$/.test(execPath)) {
-        return '/usr/local/bin/node';
-    }
-    if (/^\/opt\/homebrew\/Cellar\/node(@\d+)?\/[^/]+\/bin\/node(\.exe)?$/.test(execPath)) {
-        return '/opt/homebrew/bin/node';
+    // Homebrew (macOS Intel /usr/local, Apple Silicon /opt/homebrew, Linuxbrew
+    // /home/linuxbrew/.linuxbrew, and any custom HOMEBREW_PREFIX) pins node at
+    // <prefix>/Cellar/node(<@ver>)?/<ver>/bin/node, then deletes prior versions on
+    // `brew upgrade node`. Rewrite to the stable <prefix>/bin/node symlink, which
+    // survives the upgrade. Derive <prefix> from the path itself (more reliable
+    // than HOMEBREW_PREFIX env — the path IS the install location) so every layout
+    // is covered by one branch instead of one per known prefix (#2185).
+    const homebrewMatch = normalizedForMatch.match(/^(.+)\/Cellar\/node(@\d+)?\/[^/]+\/bin\/node(\.exe)?$/i);
+    if (homebrewMatch) {
+        return `${homebrewMatch[1]}/bin/node${homebrewMatch[3] || ''}`;
     }
     // mise pins a concrete node version at <data>/installs/node/<ver>/bin/node
     // (Windows: <data>/installs/node/<ver>/node.exe). Node realpaths
@@ -311,7 +316,7 @@ function resolveNodeRunner(opts) {
     if (!execPath)
         return null;
     const stablePath = normalizeNodePath(execPath, opts);
-    return JSON.stringify(stablePath.replace(/\\/g, '/'));
+    return JSON.stringify(shellCmdProjection.posixNormalize(stablePath));
 }
 function resolveBashRunner(opts) {
     const platform = (opts && opts.platform) || process.platform;
@@ -332,7 +337,7 @@ function resolveBashRunner(opts) {
     }
     for (const candidate of candidates) {
         if (candidate && exists(candidate)) {
-            return JSON.stringify(candidate.replace(/\\/g, '/'));
+            return JSON.stringify(shellCmdProjection.posixNormalize(candidate));
         }
     }
     return null;
@@ -372,7 +377,7 @@ function rewriteLegacyManagedNodeHookCommands(settings, absoluteRunner, opts) {
                 }
                 else {
                     _runnerToken = m[1];
-                    const runnerPath = (m[2] || m[3] || m[4] || '').replace(/\\/g, '/');
+                    const runnerPath = shellCmdProjection.posixNormalize(m[2] || m[3] || m[4] || '');
                     const stableRunner = normalizeNodePath(runnerPath);
                     if (stableRunner === runnerPath && platform !== 'win32')
                         continue;
@@ -562,10 +567,10 @@ function buildCodexHookWindowsShimIR(scriptAbsPath, absoluteRunnerToken) {
     catch {
         interpreter = absoluteRunnerToken;
     }
-    const targetAbs = scriptAbsPath.replace(/\\/g, '/');
+    const targetAbs = shellCmdProjection.posixNormalize(scriptAbsPath);
     const scriptQuoted = JSON.stringify(targetAbs);
     const cmdPath = scriptAbsPath.replace(/\.js$/, '.cmd');
-    const hookCommand = JSON.stringify(cmdPath.replace(/\\/g, '/'));
+    const hookCommand = JSON.stringify(shellCmdProjection.posixNormalize(cmdPath));
     const runnerQuoted = JSON.stringify(interpreter);
     return {
         invocation: { interpreter, target: scriptAbsPath },
@@ -584,7 +589,7 @@ function ensureCodexHooksJsonSessionStart(targetDir, opts = {}) {
     const hooksJsonPath = node_path_1.default.join(targetDir, 'hooks.json');
     if (!absoluteRunner)
         return { changed: false, wrote: false, path: hooksJsonPath };
-    const scriptPath = node_path_1.default.resolve(targetDir, 'hooks', 'gsd-check-update.js').replace(/\\/g, '/');
+    const scriptPath = shellCmdProjection.posixNormalize(node_path_1.default.resolve(targetDir, 'hooks', 'gsd-check-update.js'));
     const cmdShimPath = scriptPath.replace(/\.js$/, '.cmd');
     let managedCommand;
     if (platform === 'win32') {
@@ -614,7 +619,7 @@ function ensureCodexHooksJsonSessionStart(targetDir, opts = {}) {
     if (!managedCommand)
         return { changed: false, wrote: false, path: hooksJsonPath };
     const commandWindows = platform === 'win32'
-        ? JSON.stringify(cmdShimPath.replace(/\\/g, '/'))
+        ? JSON.stringify(shellCmdProjection.posixNormalize(cmdShimPath))
         : undefined;
     return reconcileCodexHooksJsonSessionStart(targetDir, { managedCommand, commandWindows });
 }
@@ -624,7 +629,7 @@ function ensureCodexHooksJsonEvent(targetDir, eventName, opts = {}) {
     const hooksJsonPath = node_path_1.default.join(targetDir, 'hooks.json');
     if (!absoluteRunner)
         return { changed: false, wrote: false, path: hooksJsonPath };
-    const scriptPath = node_path_1.default.resolve(targetDir, 'hooks', 'gsd-context-monitor.js').replace(/\\/g, '/');
+    const scriptPath = shellCmdProjection.posixNormalize(node_path_1.default.resolve(targetDir, 'hooks', 'gsd-context-monitor.js'));
     let managedCommand;
     if (platform === 'win32') {
         const shimIR = buildCodexHookWindowsShimIR(scriptPath, absoluteRunner);
@@ -667,6 +672,7 @@ function buildHookCommand(configDir, hookName, opts) {
         opts = {};
     const platform = opts.platform || process.platform;
     const runtime = opts.runtime || 'generic';
+    const hookShell = opts.hookShell;
     const isShellHook = hookName.endsWith('.sh');
     if (shellHookOmitsBashRunner({ platform, runtime, isShellHook })) {
         if (opts.portableHooks) {
@@ -676,7 +682,7 @@ function buildHookCommand(configDir, hookName, opts) {
             });
             return JSON.stringify(`${portableBaseDir}/hooks/${hookName}`);
         }
-        return JSON.stringify(configDir.replace(/\\/g, '/') + '/hooks/' + hookName);
+        return JSON.stringify(shellCmdProjection.posixNormalize(configDir) + '/hooks/' + hookName);
     }
     const nodeRunner = resolveNodeRunner();
     const runner = isShellHook ? resolveBashRunner(opts) : nodeRunner;
@@ -692,14 +698,16 @@ function buildHookCommand(configDir, hookName, opts) {
             scriptPath: `${portableBaseDir}/hooks/${hookName}`,
             runtime: opts.runtime || 'generic',
             platform,
+            hookShell,
         });
     }
-    const hooksPath = configDir.replace(/\\/g, '/') + '/hooks/' + hookName;
+    const hooksPath = shellCmdProjection.posixNormalize(configDir) + '/hooks/' + hookName;
     return projectManagedHookCommand({
         absoluteRunner: runner,
         scriptPath: hooksPath,
         runtime,
         platform,
+        hookShell,
     });
 }
 // ---------------------------------------------------------------------------
@@ -844,7 +852,7 @@ function writeClineArtifacts(targetDir, isGlobalInstall) {
 function buildCursorHookEntry(scriptPath) {
     return {
         type: 'command',
-        command: scriptPath.replace(/\\/g, '/'),
+        command: shellCmdProjection.posixNormalize(scriptPath),
         [GSD_CURSOR_HOOK_MARKER]: true,
     };
 }

package/gsd-core/bin/lib/schema-detect.cjs

@@ -13,6 +13,7 @@ exports.ORM_INFO = exports.SCHEMA_PATTERNS = void 0;
 exports.detectSchemaFiles = detectSchemaFiles;
 exports.detectSchemaOrm = detectSchemaOrm;
 exports.checkSchemaDrift = checkSchemaDrift;
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 exports.SCHEMA_PATTERNS = [
     { pattern: /^src\/collections\/.*\.ts$/, orm: 'payload' },
     { pattern: /^src\/globals\/.*\.ts$/, orm: 'payload' },
@@ -61,7 +62,7 @@ function detectSchemaFiles(files) {
     const matches = [];
     const orms = new Set();
     for (const rawFile of files) {
-        const file = rawFile.replace(/\\/g, '/');
+        const file = (0, shell_command_projection_cjs_1.posixNormalize)(rawFile);
         for (const { pattern, orm } of exports.SCHEMA_PATTERNS) {
             if (pattern.test(file)) {
                 matches.push(rawFile);

package/gsd-core/bin/lib/security.cjs

@@ -341,7 +341,7 @@ function sanitizeForDisplay(text) {
     let sanitized = sanitizeForPrompt(text);
     const protocolLeakPatterns = [
         /^\s*(?:assistant|user|system)\s+to=[^:\s]+:[^\n]+$/i,
-        /^\s*<\|(?:assistant|user|system)[^|]*\|>\s*$/i,
+        /^\s*<\|(?:assistant|user|system)[^|]*\|>\s*$/i, // allow-adhoc-markdown: not a GFM table-cell scan — matches `<|role|>` protocol-leak marker tokens (prompt-injection sanitization), a false-positive on the table-regex pipe+cell-class fingerprint
     ];
     sanitized = sanitized
         .split('\n')

package/gsd-core/bin/lib/shell-command-projection.cjs

@@ -15,6 +15,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPosixPath = toPosixPath;
+exports.toNativePath = toNativePath;
+exports.posixNormalize = posixNormalize;
 exports.hookCommandNeedsPowerShellCallOperator = hookCommandNeedsPowerShellCallOperator;
 exports.formatHookCommandForRuntime = formatHookCommandForRuntime;
 exports.shellHookOmitsBashRunner = shellHookOmitsBashRunner;
@@ -52,26 +55,58 @@ const node_fs_1 = __importDefault(require("node:fs"));
 // can intercept calls from this seam — destructured imports capture references
 // at load time and become un-mockable.
 const node_child_process_1 = __importDefault(require("node:child_process"));
+/**
+ * Convert a filesystem path to POSIX form (forward slashes) by translating the
+ * platform-native separator. Single seam for native→POSIX conversion.
+ *
+ * Prefer this over `p.replace(/\\/g, '/')`: the regex form hardcodes both
+ * separators and corrupts POSIX paths containing a literal backslash (a legal
+ * filename character). Splitting on `path.sep` only ever touches real
+ * separators — a no-op on POSIX, `\`→`/` on Windows.
+ */
+function toPosixPath(p) {
+    return p.split(node_path_1.default.sep).join(node_path_1.default.posix.sep);
+}
+/**
+ * Convert a filesystem path to the platform-native separator form. No-op on
+ * POSIX; `/`→`\` on Windows. Prefer this over a
+ * `process.platform === 'win32' ? p.replace(/\//g, '\\') : p` ternary.
+ */
+function toNativePath(p) {
+    return p.split(node_path_1.default.posix.sep).join(node_path_1.default.sep);
+}
+/**
+ * Normalize ALL backslashes to forward slashes, unconditionally and independent
+ * of the running OS. Use this when emitting a path into a POSIX/bash target
+ * (which may differ from the running platform — e.g. generating a Windows config
+ * on a Linux runner) or when parsing input whose separators are unpredictable.
+ *
+ * Contrast `toPosixPath`, which is running-OS-relative (splits on `path.sep`) and
+ * is for *this machine's* filesystem paths. Do NOT use `toPosixPath` for
+ * target-platform projection — on a Linux runner it would not convert a
+ * Windows-target path's backslashes.
+ */
+function posixNormalize(p) {
+    return p.replace(/\\/g, '/');
+}
 /**
  * Return true when a managed hook command must be prefixed with PowerShell's
  * call operator so a quoted executable token is invokable by the target
  * runtime/shell combination.
  *
- * Current evidence-backed policy:
- * - Claude Code on Windows does NOT need it: its hook commands execute under
- *   bash/Git Bash and `& ` breaks there (#3413).
- * - #1928: Gemini CLI — the ONLY runtime with a verified need for the `& `
- *   prefix on Windows — was removed (Google sunset it 2026-06-18). No currently
- *   supported runtime has a verified need, so this seam is now inert. It is
- *   retained (not deleted) so a future runtime with a verified need is a
- *   one-line re-enable, per the conservative policy below. Note: Antigravity —
- *   the Gemini-backend successor — never matched the old `runtime === 'gemini'`
- *   check, so its behavior (no prefix) is unchanged.
+ * The `&`/no-`&` decision is keyed on the **effective hook-execution shell**
+ * (`opts.hookShell`), not on runtime alone — a single runtime (Claude Code)
+ * can host either Git Bash or PowerShell on Windows, and no single static
+ * command string is valid in both (#2236):
+ * - Git Bash: `"node.exe" "hook.js"` works; `& "node.exe" …` → syntax error.
+ * - PowerShell: `& "node.exe" "hook.js"` works; bare `"node.exe" …` →
+ *   `Unexpected token`.
  *
- * Keep the policy conservative until another runtime has a verified need.
+ * Default is `false` (Git Bash form) for backward compatibility. Set
+ * `opts.hookShell = 'powershell'` to emit the PowerShell call-operator form.
  */
-function hookCommandNeedsPowerShellCallOperator(_opts = {}) {
-    return false;
+function hookCommandNeedsPowerShellCallOperator(opts = {}) {
+    return opts.hookShell === 'powershell';
 }
 /**
  * Project a fully-assembled hook command string for the target runtime.
@@ -122,7 +157,7 @@ function formatManagedHookScriptToken(scriptPath, opts = {}) {
     const platform = opts.platform || process.platform;
     if (platform !== 'win32')
         return null;
-    return JSON.stringify(scriptPath.replace(/\\/g, '/'));
+    return JSON.stringify(posixNormalize(scriptPath));
 }
 function projectLocalHookPrefix({ runtime: _runtime = 'claude', dirName, hookPathStyle }) {
     if (!dirName)
@@ -140,29 +175,30 @@ function projectLocalHookPrefix({ runtime: _runtime = 'claude', dirName, hookPat
         : `"$CLAUDE_PROJECT_DIR"/${dirName}`;
 }
 function projectPortableHookBaseDir({ configDir, homeDir }) {
-    const normalizedConfigDir = String(configDir || '').replace(/\\/g, '/');
-    const normalizedHome = String(homeDir || '').replace(/\\/g, '/');
+    const normalizedConfigDir = posixNormalize(String(configDir || ''));
+    const normalizedHome = posixNormalize(String(homeDir || ''));
     if (!normalizedConfigDir || !normalizedHome)
         return normalizedConfigDir;
     return normalizedConfigDir.startsWith(normalizedHome)
         ? '$HOME' + normalizedConfigDir.slice(normalizedHome.length)
         : normalizedConfigDir;
 }
-function projectShellCommandText({ runnerToken, argTokens = [], runtime = 'generic', platform = process.platform, }) {
+function projectShellCommandText({ runnerToken, argTokens = [], runtime = 'generic', platform = process.platform, hookShell, }) {
     if (!runnerToken)
         return null;
     const parts = [runnerToken, ...argTokens.filter(Boolean)];
-    return formatHookCommandForRuntime(parts.join(' '), { platform, runtime });
+    return formatHookCommandForRuntime(parts.join(' '), { platform, runtime, hookShell });
 }
-function projectManagedHookCommand({ absoluteRunner, scriptPath, runtime = 'generic', platform = process.platform }) {
+function projectManagedHookCommand({ absoluteRunner, scriptPath, runtime = 'generic', platform = process.platform, hookShell }) {
     if (!absoluteRunner || !scriptPath)
         return null;
-    const normalizedScriptPath = platform === 'win32' ? scriptPath.replace(/\\/g, '/') : scriptPath;
+    const normalizedScriptPath = platform === 'win32' ? posixNormalize(scriptPath) : scriptPath;
     return projectShellCommandText({
         runnerToken: absoluteRunner,
         argTokens: [JSON.stringify(normalizedScriptPath)],
         runtime,
         platform,
+        hookShell,
     });
 }
 const MANAGED_HOOK_BASENAMES_BY_SURFACE = {
@@ -255,14 +291,14 @@ function isManagedHookCommand(commandText, opts = {}) {
         for (const arg of opts.args) {
             if (typeof arg !== 'string')
                 continue;
-            const argBasename = arg.replace(/\\/g, '/').split('/').pop() || '';
+            const argBasename = posixNormalize(arg).split('/').pop() || '';
             if (isManagedHookBasename(argBasename, { surface }))
                 return true;
         }
     }
-    const normalizedCommand = commandText.replace(/\\/g, '/');
+    const normalizedCommand = posixNormalize(commandText);
     if (typeof opts.configDir === 'string' && opts.configDir.length > 0) {
-        const normalizedHooksDir = `${node_path_1.default.join(opts.configDir, 'hooks').replace(/\\/g, '/')}/`;
+        const normalizedHooksDir = `${posixNormalize(node_path_1.default.join(opts.configDir, 'hooks'))}/`;
         if (!normalizedCommand.includes(normalizedHooksDir))
             return false;
     }
@@ -292,7 +328,7 @@ const ANCHORED_HOOK_SCRIPT_TOKEN = /^"\$[A-Za-z_][A-Za-z0-9_]*"\//;
 function projectLegacySettingsHookCommand({ absoluteRunner, scriptPath, scriptToken, runtime = 'generic', platform = process.platform, }) {
     if (!absoluteRunner || !scriptPath)
         return null;
-    const normalizedScriptPath = platform === 'win32' ? scriptPath.replace(/\\/g, '/') : scriptPath;
+    const normalizedScriptPath = platform === 'win32' ? posixNormalize(scriptPath) : scriptPath;
     // #1693: a script path already carrying a `"$CLAUDE_PROJECT_DIR"`-anchored
     // quoted prefix (local installs) is already a valid shell token — only the
     // variable is quoted, the rest is bare. JSON.stringify-ing it on Windows
@@ -350,7 +386,7 @@ function projectPathActionProjection({ mode = 'repair', targetDir, platform = pr
     let shellActions;
     if (isWin32) {
         const psTargetDir = escapePowerShellSingleQuoted(targetDir);
-        const bashTargetDir = escapeSingleQuotedShellLiteral(String(targetDir).replace(/\\/g, '/'));
+        const bashTargetDir = escapeSingleQuotedShellLiteral(posixNormalize(String(targetDir)));
         shellActions = [
             {
                 label: 'PowerShell',

package/gsd-core/bin/lib/smart-entry.cjs

@@ -42,6 +42,7 @@ exports.runSmartEntry = runSmartEntry;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output } = ioMod;
@@ -274,9 +275,9 @@ function detectSignals(cwd, now = Date.now) {
         fmScalar(fm, body, 'progress', 'Progress');
     // Blockers list: `- <text>` items under a `## Blockers` heading.
     const blockers = [];
-    const blockersMatch = body.match(/##\s*Blockers\s*\n([\s\S]*?)(?=\n##|$)/i); // allow-adhoc-markdown: read-only blockers section-collect in smart-entry.cts; mirrors state.cts (#1372), pending collectSection migration
-    if (blockersMatch) {
-        const items = blockersMatch[1].match(/^-\s+(.+)$/gm) || [];
+    const blockersSection = (0, markdown_sectionizer_cjs_1.collectSection)(body, (h) => h.level === 2 && h.text.trim().toLowerCase() === 'blockers', { levelBounded: true });
+    if (blockersSection) {
+        const items = blockersSection.body.match(/^-\s+(.+)$/gm) || [];
         for (const item of items)
             blockers.push(item.replace(/^-\s+/, '').trim());
     }

package/gsd-core/bin/lib/state-transition.cjs

@@ -28,7 +28,7 @@ const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const phase_lifecycle_cjs_1 = require("./phase-lifecycle.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { extractFrontmatter, reconstructFrontmatter } = frontmatter;
+const { extractFrontmatter, reconstructFrontmatter, stripFrontmatter } = frontmatter;
 const { escapeRegex } = phaseIdMod;
 // Stop predicate for section-body slicing: a level-2+ heading ends the section.
 const STOP_H2_PLUS = (lv) => lv >= 2;
@@ -226,7 +226,7 @@ function beginPhaseCore(content, intent, deps) {
     const reassemble = (b) => hasFrontmatter
         ? `---\n${reconstructFrontmatter(existingFm)}\n---\n\n${b}`
         : b;
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     // Consult the field-classification table for the frontmatter keys this
     // transition touches (codex Phase 1 review: "table not consulted by
     // transitionCore"). The table tracks FRONTMATTER keys (lowercase: `status`,
@@ -284,8 +284,8 @@ function beginPhaseCore(content, intent, deps) {
             updated.push('Current focus');
         }
         // ## Current Position section mutation (#1104, #1365).
-        // ADR-1372 T6: tokenizeHeadings + offset splicing (replaceSection adoption
-        // deferred to a later phase). Mirrors state.cts:2261-2324 byte-for-behaviour.
+        // `locateCurrentPosition` (fence-aware, tokenizeHeadings-based) locates
+        // the section; mirrors state.cts:2261-2324 byte-for-behaviour.
         body = mutateCurrentPositionFirstTime(body, intent, today, updated);
     }
     else {
@@ -338,6 +338,20 @@ function sliceCurrentPositionSection(body) {
  * First-time ## Current Position mutation: update Phase / Plan / Status /
  * Last activity lines. Mirrors state.cts:2261-2324 byte-for-behaviour
  * (inline regex first, pipe-table fallback via stateReplaceField — #1257).
+ *
+ * F2 (#2245 review, MAJOR): a prior revision of this function used
+ * `collectSection`/`replaceSection` here, whose default `levelBounded: true`
+ * only stops the section at the next heading of level <= the opener's own
+ * level (H1/H2 for a `##`-opened section) — an H3+ subsection nested under
+ * `## Current Position` was NOT a stop boundary and got folded into
+ * `sectionBody`, so the field regexes below (which run with the `m` flag,
+ * matching ANY line start in the body) could clobber a same-named line
+ * inside that subsection (the #2130/#2067/#2080 truncation/clobber class).
+ * Restored to the fence-aware `locateCurrentPosition` locator (which stops
+ * at ANY heading level >= 2, `STOP_H2_PLUS` — H2 through H6) + manual splice,
+ * exactly matching the `mutateCurrentPositionResume`/
+ * `mutateCurrentPositionForAdvance` siblings below, both of which use
+ * `locateCurrentPosition` directly.
  */
 function mutateCurrentPositionFirstTime(body, intent, today, updated) {
     const span = locateCurrentPosition(body);
@@ -414,25 +428,6 @@ function mutateCurrentPositionResume(body, intent, today, updated) {
     }
     return body.slice(0, span.start) + sectionBody + body.slice(span.end);
 }
-/**
- * Strip ALL frontmatter blocks from the start of `content`.
- *
- * TODO (ADR-1769 follow-up): move to `frontmatter.cjs` or `state-document.cjs`
- * so it's a shared primitive. Inlined here in Phase 1 to avoid touching
- * `state.cjs` (which is the migration target itself) and to keep the Phase 1
- * diff contained. Body is byte-identical to `state.cts:1653 stripFrontmatter`
- * (same CRLF + stacked-block handling).
- */
-function stripFrontmatter(content) {
-    let result = content;
-    while (true) {
-        const stripped = result.replace(/^\s*---\r?\n[\s\S]*?\r?\n---\s*/, '');
-        if (stripped === result)
-            break;
-        result = stripped;
-    }
-    return result;
-}
 /**
  * Update fields within the ## Current Position section for advancePlan.
  * Mirrors `updateCurrentPositionFields` (state.cts:496) byte-for-behaviour:
@@ -502,7 +497,7 @@ function mutateCurrentPositionForAdvance(content, fields, statusDefaults, lastAc
  * adapter to construct CLI output.
  */
 function advancePlanCore(content, deps) {
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     // #1255: body-field replacements operate on body only (frontmatter stripped),
     // not on the full content. The YAML `status:` key matches `^Status:\s*`
     // before the body field if full content is passed (codex Phase 2 review:
@@ -591,8 +586,8 @@ function advancePlanCore(content, deps) {
  * Migrates the inline STATE.md transform that lived inside `cmdPhaseComplete`
  * (phase.cts) onto the substrate. Owns the field-classification-governed body
  * mutations: Current Phase (preserving the `of total` shape and phase name),
- * Current Phase Name, Status (`Milestone complete` on the last phase, else
- * `Ready to plan`), Current Plan (`Not started`), Last Activity + Description,
+ * Current Phase Name, Status (`All phases complete` on the last phase, else
+ * `Ready to plan` per ADR-2207), Current Plan (`Not started`), Last Activity + Description,
  * and the Completed/Total Phases + Progress percent block (re-derived from the
  * roadmap via the injected `roadmapProvider`).
  *
@@ -608,7 +603,7 @@ function advancePlanCore(content, deps) {
  */
 function completePhaseCore(content, intent, deps) {
     const updated = [];
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     // Consult the field-classification table for the frontmatter keys this
     // transition touches (same guard beginPhaseCore applies). A missing row is a
     // substrate defect — fail loudly rather than silently re-encoding policy.
@@ -672,8 +667,10 @@ function completePhaseCore(content, intent, deps) {
             updated.push('Current Phase Name');
         }
     }
-    // Status — `Milestone complete` on the final phase, otherwise `Ready to plan`.
-    const statusValue = intent.isLastPhase ? 'Milestone complete' : 'Ready to plan';
+    // Status — `All phases complete` on the final phase (ADR-2207), otherwise
+    // `Ready to plan`. Milestone termination (`<version> milestone complete`) is
+    // owned solely by the milestone-close verb (milestoneCompleteCore).
+    const statusValue = intent.isLastPhase ? 'All phases complete' : 'Ready to plan';
     const statusAfter = (0, state_document_cjs_1.stateReplaceFieldWithFallback)(body, 'Status', null, statusValue);
     if (statusAfter !== body) {
         body = statusAfter;
@@ -762,7 +759,7 @@ function completePhaseCore(content, intent, deps) {
  */
 function plannedPhaseCore(content, intent, deps) {
     const updated = [];
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     for (const fmKey of ['status', 'last_activity', 'last_activity_desc']) {
         const cls = getFieldClassification(fmKey);
         if (cls === null) {
@@ -840,7 +837,7 @@ function plannedPhaseCore(content, intent, deps) {
  * directly and must not run the steady-state `syncStateFrontmatter` post-sync.
  */
 function milestoneSwitchCore(content, intent, deps) {
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     const updated = [
         'milestone',
         'milestone_name',
@@ -903,6 +900,70 @@ function milestoneSwitchCore(content, intent, deps) {
 // ----------------------------------------------------------------------------
 // milestoneComplete — intent implementation (Phase 5)
 // ----------------------------------------------------------------------------
+/**
+ * Replace a section's ENTIRE body with `newBody`, discarding whatever was
+ * there — the "wholesale reset" write pattern used by milestoneComplete's
+ * closure write (## Current Position / ## Operator Next Steps). Retires the
+ * fence-blind raw regex `(##\s*<heading>\s*\n)([\s\S]*?)(?=\n##|$)`, which a
+ * literal `##` inside a fenced code block in the section body could fool into
+ * stopping early (the #2130/#2067/#2080 truncation class) — heading location
+ * here goes through `tokenizeHeadings`, which is fence-aware.
+ *
+ * Byte-parity note: the retired regex's greedy `\s*` (before its mandatory
+ * `\n`) swallowed any blank line(s) immediately after the heading into the
+ * discarded match, and its non-greedy body match always left exactly ONE
+ * newline unconsumed before the next heading (or EOF), regardless of how many
+ * blank lines originally separated the section from what followed. Both
+ * edges are reproduced explicitly (rather than delegated to `collectSection`'s
+ * `trimEnd()`-based body, which trims a *different* amount and would drift
+ * the surrounding blank-line count) so `newBody`'s own leading/trailing
+ * formatting is exactly what appears in the output.
+ *
+ * Returns `null` when no heading matches `headingPredicate` (mirrors the
+ * retired regex's `pattern.test(body)` miss) — callers fall back to their own
+ * append-a-new-section path.
+ */
+function resetSectionVerbatim(content, headingPredicate, newBody) {
+    const headings = (0, markdown_sectionizer_cjs_1.tokenizeHeadings)(content);
+    const idx = headings.findIndex(headingPredicate);
+    if (idx === -1)
+        return null;
+    const target = headings[idx];
+    const lines = content.split('\n');
+    const headingLineEnd = target.offset + lines[target.line - 1].length + 1;
+    // Swallow blank line(s) immediately after the heading (mirrors the retired
+    // regex's greedy `\s*` folding them into the discarded match).
+    //
+    // F7 (#2245 review, nit): recognise a CRLF blank line (`\r\n`), not only a
+    // bare LF — a lone `content[bodyStart] === '\n'` check never advances past
+    // a `\r` byte, so on a CRLF STATE.md the blank line right after the
+    // heading fell into the DISCARDED [bodyStart, bodyEnd) span instead of the
+    // KEPT prefix, silently dropping one blank line (contradicting this
+    // function's own byte-parity docstring).
+    let bodyStart = headingLineEnd;
+    while (bodyStart < content.length) {
+        if (content[bodyStart] === '\n') {
+            bodyStart += 1;
+            continue;
+        }
+        if (content[bodyStart] === '\r' && content[bodyStart + 1] === '\n') {
+            bodyStart += 2;
+            continue;
+        }
+        break;
+    }
+    // Stop at the next heading of level >= 2 (mirrors the retired regex's
+    // literal `##` lookahead, which matches any ATX heading two-or-more levels
+    // deep); leave exactly one newline unconsumed before it, or run to EOF.
+    let bodyEnd = content.length;
+    for (let j = idx + 1; j < headings.length; j++) {
+        if (STOP_H2_PLUS(headings[j].level)) {
+            bodyEnd = headings[j].offset - 1;
+            break;
+        }
+    }
+    return content.slice(0, bodyStart) + newBody + content.slice(bodyEnd);
+}
 /**
  * Apply a `milestoneComplete` transition to STATE.md content.
  *
@@ -917,17 +978,11 @@ function milestoneSwitchCore(content, intent, deps) {
  * runtime-specific next-milestone slash command, injecting it via
  * `intent.nextMilestoneCommand` so the core stays pure.
  *
- * The two section resets use raw regex (with the pre-seam `allow-adhoc-markdown`
- * waivers carried from milestone.cts) rather than tokenizeHeadings because the
- * `## Operator Next Steps` section is non-canonical (not in STATE_MD_SECTIONS)
- * and the existing behavior + its tests pin the exact regex semantics. A future
- * collectSection migration (#1372) can swap both to section primitives.
- *
  * Behavior is byte-for-byte with the pre-migration milestone.cts:314-353 block.
  */
 function milestoneCompleteCore(content, intent, deps) {
     const updated = [];
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     const version = intent.version;
     for (const fmKey of ['status', 'last_activity', 'last_activity_desc']) {
         const cls = getFieldClassification(fmKey);
@@ -963,22 +1018,22 @@ function milestoneCompleteCore(content, intent, deps) {
     }
     // ## Current Position reset — stop resume/progress flows pointing at closed
     // execution instructions.
-    const positionPattern = /(##\s*Current Position\s*\n)([\s\S]*?)(?=\n##|$)/i; // allow-adhoc-markdown: pre-seam section write-modify carried from milestone.cts; pending collectSection migration #1372
     const closedPositionBody = `\nPhase: Milestone ${version} complete\n` +
         `Plan: —\n` +
         `Status: Awaiting next milestone\n` +
         `Last activity: ${today} — Milestone ${version} completed and archived\n\n`;
-    if (positionPattern.test(body)) {
-        body = body.replace(positionPattern, (_m, header) => `${header}${closedPositionBody}`);
+    const positionReset = resetSectionVerbatim(body, (h) => h.level === 2 && /^current\s+position$/i.test(h.text), closedPositionBody);
+    if (positionReset !== null) {
+        body = positionReset;
     }
     else {
         body = `${body.trimEnd()}\n\n## Current Position\n${closedPositionBody}`;
     }
     updated.push('Current Position');
     // ## Operator Next Steps — normalize stale tails that can persist after close.
-    const operatorPattern = /(##\s*Operator Next Steps\s*\n)([\s\S]*?)(?=\n##|$)/i; // allow-adhoc-markdown: pre-seam section write-modify carried from milestone.cts; pending collectSection migration #1372
-    if (operatorPattern.test(body)) {
-        body = body.replace(operatorPattern, `$1\n- Start the next milestone with ${intent.nextMilestoneCommand}\n\n`);
+    const operatorReset = resetSectionVerbatim(body, (h) => h.level === 2 && /^operator\s+next\s+steps$/i.test(h.text), `\n- Start the next milestone with ${intent.nextMilestoneCommand}\n\n`);
+    if (operatorReset !== null) {
+        body = operatorReset;
     }
     else {
         body = `${body.trimEnd()}\n\n## Operator Next Steps\n\n- Start the next milestone with ${intent.nextMilestoneCommand}\n`;
@@ -1175,7 +1230,7 @@ function pruneCore(content, intent) {
  * (rather than silently writing fallback-derived wrong values).
  */
 function syncCore(content, intent, deps) {
-    const today = deps.clock.today();
+    const today = deps.clock.localToday();
     const changes = [];
     let modified = content;
     const updated = [];