@opengsd/gsd-pi 1.2.0-dev.4c756166 → 1.2.0-dev.6ccd27b3

package/dist/resources/extensions/gsd/state.js

@@ -3,6 +3,11 @@
 // GSD Extension — State Derivation
 // DB-authoritative runtime derivation with explicit legacy filesystem fallback.
 // Pure TypeScript, zero Pi dependencies.
+// Pre-migration fallback ONLY (ADR-017): deriveState must work on projects
+// whose DB does not exist yet (before md-importer runs), so it parses markdown
+// projections when `isDbAvailable()` is false or the DB has no rows. Once the
+// DB is populated, decision reads go through gsd-db queries — these parsers
+// must never be consulted when DB data is present.
 import { parseRoadmap, parsePlan, } from './parsers-legacy.js';
 import { parseSummary, loadFile, parseRequirementCounts, parseContextDependsOn, } from './files.js';
 import { resolveMilestoneFile, resolveSlicePath, resolveSliceFile, resolveTaskFile, resolveTasksDir, resolveGsdRootFile, gsdRoot, } from './paths.js';
@@ -18,30 +23,11 @@ import { logWarning } from './workflow-logger.js';
 import { extractVerdict } from './verdict-parser.js';
 import { detectPendingEscalation } from './escalation.js';
 import { isTerminalMilestoneSummaryContent } from './milestone-summary-classifier.js';
-import { isDbAvailable, getAllMilestones, getMilestone, getMilestoneSlices, getSliceTasks, getReplanHistory, getSlice, getRequirementCounts, getLatestAssessmentByScope, getPendingGateCountForTurn, } from './gsd-db.js';
+import { isDbAvailable, getAllMilestones, getMilestone, getSlicesByMilestoneIds, getSliceTasks, getReplanHistory, getSlice, getRequirementCounts, getLatestAssessmentByScope, getPendingGateCountForTurn, } from './gsd-db.js';
 import { wasWorkflowDatabaseOpenAttempted } from './db-workspace.js';
 import { formatCompletePhaseNextAction, countUnmappedActiveRequirements } from './requirements-backlog.js';
 import { classifyMilestoneReadiness, readinessNeedsDiscussion, } from './milestone-readiness.js';
-function formatNeedsAttentionBlocker(milestoneId) {
-    return [
-        `Milestone ${milestoneId} is blocked because milestone validation returned needs-attention.`,
-        `Fix options:`,
-        `1. Review the validation details: \`/gsd status\``,
-        `2. If you fixed the missing evidence or issue, re-run milestone validation: \`/gsd validate-milestone\``,
-        `3. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-        `4. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-        `After validation or override passes, run \`/gsd auto\` to complete and merge the milestone.`,
-    ].join("\n");
-}
-function formatNeedsRemediationBlocker(milestoneId) {
-    return [
-        `Milestone ${milestoneId} is blocked because milestone validation returned needs-remediation, but all slices are complete.`,
-        `Fix options:`,
-        `1. Run \`/gsd dispatch reassess\` to add remediation slices, then run \`/gsd auto\``,
-        `2. If the finding is acceptable, override it: \`/gsd verdict pass --rationale "why this is okay"\``,
-        `3. If this should wait, defer it explicitly: \`/gsd park ${milestoneId}\``,
-    ].join("\n");
-}
+import { needsAttentionBlockerGuidance as formatNeedsAttentionBlocker, needsRemediationBlockerGuidance as formatNeedsRemediationBlocker, } from './guidance.js';
 /**
  * A "ghost" milestone directory contains only META.json (and no substantive
  * files like CONTEXT, CONTEXT-DRAFT, ROADMAP, or SUMMARY).  These appear when
@@ -380,12 +366,16 @@ async function buildRegistryAndFindActive(basePath, milestones, completeMileston
     let activeMilestoneFound = false;
     let activeMilestoneHasDraft = false;
     let firstDeferredQueuedShell = null;
+    const activeMilestoneIds = milestones
+        .filter((m) => !parkedMilestoneIds.has(m.id))
+        .map((m) => m.id);
+    const slicesByMilestone = getSlicesByMilestoneIds(activeMilestoneIds);
     for (const m of milestones) {
         if (parkedMilestoneIds.has(m.id)) {
             registry.push({ id: m.id, title: stripMilestonePrefix(m.title) || m.id, status: 'parked' });
             continue;
         }
-        const slices = getMilestoneSlices(m.id);
+        const slices = slicesByMilestone.get(m.id) ?? [];
         // DB-authoritative completeness (#4179): only trust completeMilestoneIds,
         // which is itself derived from DB status. SUMMARY-file presence alone must
         // not imply completion.

package/dist/resources/extensions/gsd/status-guards.js

@@ -1,16 +1,64 @@
 /**
- * Status predicates for GSD state-machine guards.
+ * Status predicates and the canonical status vocabulary for GSD state-machine
+ * guards (ADR-030).
  *
- * The DB stores status as free-form strings. Three values indicate
- * "closed": "complete" (canonical), "done" (legacy / alias),
- * "closed" (legacy/imported), and
- * "skipped" (user-directed skip via rethink or backtrack).
- * Every inline `status === "complete" || status === "done"` should
- * use isClosedStatus() instead.
+ * The DB column is free-form `string` so legacy/imported rows still load. Three
+ * raw values besides canonical "complete"/"skipped" indicate "closed": "done"
+ * (legacy alias), "closed" (legacy/imported), and "skipped" (user-directed skip
+ * via rethink or backtrack). `RAW_CLOSED_STATUSES` is the single source for both
+ * `isClosedStatus()` and the SQL terminal-status fragment
+ * (`db/sql-constants.ts` derives `TERMINAL_STATUS_SQL` from it), replacing the
+ * prior independent definitions.
+ *
+ * `toStatus()` is the single seam where a free-form string becomes the canonical
+ * `Status` vocabulary; the Status Transition Core writes canonical, so the store
+ * converges over time without a forced migration.
+ */
+/**
+ * Canonical, normalized entity-status vocabulary across milestones, slices, and
+ * tasks — the single source for both the `Status` type and the runtime
+ * membership set. The in-memory domain speaks `Status`; the DB column stays
+ * free-form.
+ */
+export const CANONICAL_STATUSES = [
+    "pending", "queued", "active", "parked", "in_progress", "blocked", "complete", "skipped", "deferred",
+];
+const CANONICAL_STATUS_SET = new Set(CANONICAL_STATUSES);
+/**
+ * Raw status values that mean a unit is closed — the single source of truth.
+ * Includes legacy/imported aliases ("done", "closed") alongside canonical
+ * "complete"/"skipped" because the DB column is free-form and older rows /
+ * imports still carry them. Order matters: `TERMINAL_STATUS_SQL` is derived
+ * from this array verbatim.
+ */
+export const RAW_CLOSED_STATUSES = ["complete", "done", "skipped", "closed"];
+const RAW_CLOSED_SET = new Set(RAW_CLOSED_STATUSES);
+/** Free-form aliases mapped to their canonical Status on read. */
+const ALIAS_TO_CANONICAL = {
+    done: "complete",
+    closed: "complete",
+    planned: "pending",
+    "in-progress": "in_progress",
+};
+/**
+ * Normalize a free-form DB status string into the canonical `Status`
+ * vocabulary. Maps known aliases (done/closed → complete, planned → pending,
+ * in-progress → in_progress). An unrecognized/legacy value is **quarantined** —
+ * preserved verbatim rather than silently remapped to a wrong canonical state —
+ * so reads never fail and reconciliation/telemetry can surface it.
  */
+export function toStatus(raw) {
+    const value = raw.trim();
+    if (CANONICAL_STATUS_SET.has(value))
+        return value;
+    const alias = ALIAS_TO_CANONICAL[value];
+    if (alias)
+        return alias;
+    return value;
+}
 /** Returns true when a milestone, slice, or task status indicates closure. */
 export function isClosedStatus(status) {
-    return status === "complete" || status === "done" || status === "skipped" || status === "closed";
+    return RAW_CLOSED_SET.has(status);
 }
 /** Returns true when a slice status indicates it was deferred by a decision. */
 export function isDeferredStatus(status) {

package/dist/resources/extensions/gsd/stop-notice.js

@@ -0,0 +1,57 @@
+// Project/App: gsd-pi
+// File Purpose: Stop Notice module — single owner of the auto/step-mode
+// stop/pause notice vocabulary. Both sides of the wire live here: the
+// formatters that produce the canonical prefixes (used by stopAuto/pauseAuto)
+// and the classifiers that recognize them (used by the headless host to pick
+// exit codes). Wording changes in this file keep emitter and detector in
+// lockstep; round-trip tests enforce it.
+/** A reason string of the form "Blocked: …" marks a blocked stop. */
+export function isBlockedStopReason(reason) {
+    return /^Blocked:\s*/i.test(reason ?? "");
+}
+/** Strip the "Blocked: " marker for display. */
+export function stopNoticeDisplayReason(reason) {
+    return (reason ?? "").replace(/^Blocked:\s*/i, "").trim();
+}
+export function stopNoticeKind(reason) {
+    return isBlockedStopReason(reason) ? "blocked" : "stopped";
+}
+/** Canonical stop-notice prefix: "Auto-mode blocked — reason" / "Auto-mode stopped". */
+export function formatStopNoticePrefix(reason) {
+    const displayReason = stopNoticeDisplayReason(reason);
+    const prefix = stopNoticeKind(reason) === "blocked" ? "Auto-mode blocked" : "Auto-mode stopped";
+    return displayReason ? `${prefix} — ${displayReason}` : prefix;
+}
+// ─── Classification (headless host side) ────────────────────────────────
+// The canonical lowercase prefixes the headless event loop recognizes in
+// notify messages. Emitters above and ad-hoc emitters elsewhere must start
+// their terminal notices with one of these.
+export const PAUSED_NOTICE_PREFIXES = ["auto-mode paused", "step-mode paused"];
+export const TERMINAL_NOTICE_PREFIXES = [
+    "auto-mode stopped",
+    "step-mode stopped",
+    "auto-mode complete",
+    "no active milestone",
+    "auto-mode idle",
+];
+/** Manual-resolution notices emitted before auto-mode can formally pause/stop. */
+export function isManualResolutionNotice(message) {
+    return (message.includes("resolve manually and re-run /gsd auto") ||
+        message.includes("resolve conflicts manually and run /gsd auto to resume") ||
+        message.includes("resolve and run /gsd auto to resume"));
+}
+export function isPauseNotice(message) {
+    return PAUSED_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+export function isTerminalNotice(message) {
+    return TERMINAL_NOTICE_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+/** Pauses that do not require operator intervention in headless mode. */
+export function isNonBlockingPauseNotice(message) {
+    return message.includes("idempotent advance: unit already active");
+}
+export function isBlockedNoticeMessage(message) {
+    return (message.includes("blocked:") ||
+        (isPauseNotice(message) && !isNonBlockingPauseNotice(message)) ||
+        isManualResolutionNotice(message));
+}

package/dist/resources/extensions/gsd/tool-contract.js

@@ -1,8 +1,8 @@
 // Project/App: gsd-pi
 // File Purpose: ADR-015 Tool Contract module for Unit prompt, policy, and tool parity.
 import { resolveManifest, } from "./unit-context-manifest.js";
-import { getRequiredWorkflowToolsForAutoUnit } from "./workflow-mcp.js";
-import { getUnitToolSurfaceContract } from "./unit-tool-contracts.js";
+import { getWorkflowTransportSupportError, } from "./workflow-mcp.js";
+import { getRequiredWorkflowToolsForUnit, getUnitToolSurfaceContract, } from "./unit-tool-contracts.js";
 import { WHOLE_FILE_OBSERVATION_MAX_BYTES, WHOLE_FILE_OBSERVATION_MAX_LINES, } from "./source-observations.js";
 export function compileUnitContextContract(unitType) {
     const manifest = resolveManifest(unitType);
@@ -15,6 +15,17 @@ export function compileUnitContextContract(unitType) {
     }
     return { ok: true, contract: buildPromptContextContract(unitType, manifest) };
 }
+export function getUnitWorkflowDispatchReadinessError(input) {
+    return getWorkflowTransportSupportError(input.provider, getRequiredWorkflowToolsForUnit(input.unitType), {
+        projectRoot: input.projectRoot,
+        env: input.env,
+        surface: input.surface,
+        unitType: input.unitType,
+        authMode: input.authMode,
+        baseUrl: input.baseUrl,
+        activeTools: input.activeTools,
+    });
+}
 export function compileUnitToolContract(unitType) {
     const manifest = resolveManifest(unitType);
     const surfaceContract = getUnitToolSurfaceContract(unitType);
@@ -25,7 +36,7 @@ export function compileUnitToolContract(unitType) {
             detail: `No Unit manifest is registered for ${unitType}`,
         };
     }
-    const requiredWorkflowTools = getRequiredWorkflowToolsForAutoUnit(unitType);
+    const requiredWorkflowTools = getRequiredWorkflowToolsForUnit(unitType);
     const forbiddenWorkflowTools = Object.entries(surfaceContract?.forbiddenGsdTools ?? {})
         .map(([name, reason]) => ({ name, reason }));
     const closeoutTools = requiredWorkflowTools.filter((tool) => /^gsd_(?:task|slice|milestone|complete|validate|save|summary|uat)/.test(tool));

package/dist/resources/extensions/gsd/tool-presentation-plan.js

@@ -4,7 +4,7 @@ import { RUN_UAT_BROWSER_TOOL_NAMES, RUN_UAT_READ_ONLY_TOOL_NAMES, RUN_UAT_TOOL_
 import { toMcpToolName } from "./mcp-tool-name.js";
 import { createToolSurfaceSnapshot } from "./tool-surface-snapshot.js";
 import { uatTypeIncludesBrowser } from "./uat-policy.js";
-import { canonicalWorkflowSurfaceToolName } from "./workflow-tool-surface.js";
+import { canonicalWorkflowToolName } from "./engine-hook-contract.js";
 export { RUN_UAT_BROWSER_TOOL_NAMES, RUN_UAT_READ_ONLY_TOOL_NAMES, RUN_UAT_TOOL_PRESENTATION_PLAN_ID, RUN_UAT_WORKFLOW_TOOL_NAMES, } from "./unit-tool-contracts.js";
 export const RUN_UAT_FORBIDDEN_TOOL_NAMES = [
     "edit",
@@ -24,9 +24,9 @@ export const RUN_UAT_CLAUDE_NATIVE_TOOL_NAMES = [
     "Glob",
     "Grep",
 ];
-export function canonicalWorkflowToolName(toolName) {
-    return canonicalWorkflowSurfaceToolName(toolName);
-}
+// Normalizer seam lives in engine-hook-contract.ts; re-exported here for
+// existing presentation importers (uat-run.ts).
+export { canonicalWorkflowToolName };
 export { parseMcpToolName } from "./mcp-tool-name.js";
 export function toWorkflowMcpToolName(serverName, toolName) {
     return toMcpToolName(serverName, canonicalWorkflowToolName(toolName));

package/dist/resources/extensions/gsd/tool-surface-readiness.js

@@ -0,0 +1,108 @@
+// Project/App: gsd-pi
+// File Purpose: Tool Contract module's runtime face — verify the live SDK tool surface covers a Unit's required workflow tools.
+import { testMcpServerConnection } from "../mcp-client/manager.js";
+import { mcpToolMatchesBaseName } from "./mcp-tool-name.js";
+import { getRequiredWorkflowToolsForUnit } from "./unit-tool-contracts.js";
+import { recordWorkflowMcpProbe, WORKFLOW_MCP_PROBE_TIMEOUT_MS, } from "./workflow-mcp-readiness-cache.js";
+import { resolveWorkflowMcpProjectRoot } from "./workflow-mcp.js";
+import { isWorkflowToolSurfaceName } from "./workflow-tool-surface.js";
+/**
+ * Stable phrase recognized as transient by auto-tool-tracking's
+ * isToolUnavailableError and error-classifier's transient buckets,
+ * which build their matchers from this constant.
+ */
+export const TOOL_SURFACE_NOT_READY = "workflow tool surface not ready";
+/** MCP server statuses that will not self-heal within the session. */
+const TERMINAL_MCP_SERVER_STATUSES = new Set(["failed", "needs-auth", "disabled"]);
+export const DEFAULT_WORKFLOW_MCP_PREFLIGHT_TIMEOUT_MS = 30_000;
+export const DEFAULT_WORKFLOW_MCP_PREFLIGHT_POLL_MS = 200;
+const RUN_UAT_PREFLIGHT_TIMEOUT_MS = 90_000;
+function resolveWorkflowMcpPreflightTimeoutMs(unitType) {
+    if (unitType === "run-uat")
+        return RUN_UAT_PREFLIGHT_TIMEOUT_MS;
+    return DEFAULT_WORKFLOW_MCP_PREFLIGHT_TIMEOUT_MS;
+}
+export function probeCoversRequiredWorkflowTools(tools, required) {
+    return required.every((tool) => tools.some((name) => name === tool || mcpToolMatchesBaseName(name, tool)));
+}
+export async function awaitWorkflowMcpToolRegistration(input) {
+    const { unitType, workflowServerName, projectRoot } = input;
+    if (!unitType || !workflowServerName)
+        return null;
+    const required = getRequiredWorkflowToolsForUnit(unitType).filter(isWorkflowToolSurfaceName);
+    if (required.length === 0)
+        return null;
+    const probe = input.probe ?? (async (serverName, root) => {
+        const result = await testMcpServerConnection(serverName, {
+            projectDir: resolveWorkflowMcpProjectRoot(root),
+            timeoutMs: WORKFLOW_MCP_PROBE_TIMEOUT_MS,
+        });
+        return { ok: result.ok, tools: result.tools };
+    });
+    const deadline = Date.now() + (input.timeoutMs ?? resolveWorkflowMcpPreflightTimeoutMs(unitType));
+    const pollMs = input.pollMs ?? DEFAULT_WORKFLOW_MCP_PREFLIGHT_POLL_MS;
+    while (Date.now() < deadline) {
+        throwIfAborted(input.signal);
+        const result = await probe(workflowServerName, projectRoot);
+        throwIfAborted(input.signal);
+        if (result.ok && probeCoversRequiredWorkflowTools(result.tools, required)) {
+            recordWorkflowMcpProbe(projectRoot, workflowServerName, result.tools);
+            return null;
+        }
+        await sleep(pollMs, input.signal);
+    }
+    return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" did not register required tools before session start: ${required.join(", ")}`;
+}
+function makeAbortError() {
+    const error = new Error("AbortError: The operation was aborted");
+    error.name = "AbortError";
+    return error;
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw makeAbortError();
+}
+function sleep(ms, signal) {
+    throwIfAborted(signal);
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timeout);
+            reject(makeAbortError());
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** Brief pause after a successful preflight before SDK query (race with MCP attach). */
+export const POST_PREFLIGHT_SDK_SETTLE_MS = 750;
+export const POST_PREFLIGHT_READINESS_RETRY_DELAYS_MS = [
+    1_000, 2_000, 3_000, 5_000, 8_000, 10_000, 15_000, 15_000, 15_000, 15_000,
+];
+export function getToolSurfaceReadinessError(input) {
+    const { unitType, workflowServerName, observation } = input;
+    if (!unitType || !workflowServerName)
+        return null;
+    const required = getRequiredWorkflowToolsForUnit(unitType).filter(isWorkflowToolSurfaceName);
+    if (required.length === 0)
+        return null;
+    const server = observation.mcpServers.find((entry) => entry.name === workflowServerName);
+    if (server && TERMINAL_MCP_SERVER_STATUSES.has(server.status)) {
+        const missing = required.filter((tool) => !observation.tools.some((name) => name === tool || mcpToolMatchesBaseName(name, tool)));
+        const tools = missing.length > 0 ? missing : required;
+        return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" status is "${server.status}" (terminal) — cannot register: ${tools.join(", ")}`;
+    }
+    const missing = required.filter((tool) => !observation.tools.some((name) => name === tool || mcpToolMatchesBaseName(name, tool)));
+    if (missing.length === 0) {
+        return null;
+    }
+    if (!server) {
+        return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" is absent from the init surface (not yet connected): ${missing.join(", ")}`;
+    }
+    if (server.status !== "connected") {
+        return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" status is "${server.status}" (not yet connected): ${missing.join(", ")}`;
+    }
+    return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" is connected but has not registered: ${missing.join(", ")}`;
+}

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -16,7 +16,8 @@ import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
 import { isClosedStatus } from "../status-guards.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
-import { renderAllProjections, stripIdPrefix } from "../workflow-projections.js";
+import { stripIdPrefix } from "../workflow-projections.js";
+import { flushWorkflowProjections } from "../projection-flush.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning, logError } from "../workflow-logger.js";
@@ -166,7 +167,7 @@ export async function handleCompleteMilestone(params, basePath) {
     // Separate try/catch per step so a projection failure doesn't prevent
     // the event log entry (critical for worktree reconciliation).
     try {
-        await renderAllProjections(artifactBasePath, params.milestoneId);
+        await flushWorkflowProjections(artifactBasePath, { milestoneId: params.milestoneId });
     }
     catch (projErr) {
         logWarning("tool", `complete-milestone projection warning: ${projErr.message}`);

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -11,19 +11,17 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { isClosedStatus } from "../status-guards.js";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, getMilestoneSlices, updateMilestoneStatus, } from "../gsd-db.js";
+import { completeSliceCascade, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, } from "../gsd-db.js";
 import { getGatesForTurn } from "../gate-registry.js";
 import { gsdProjectionRoot, clearPathCache, resolveMilestoneFile } from "../paths.js";
 import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
 import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
-import { getDeclaredUatType, shouldEscalateArtifactUatToBrowser } from "../uat-policy.js";
+import { classifyUatContent, escalatesArtifactUatToBrowser } from "../uat-policy.js";
 import { invalidateStateCache } from "../state.js";
-import { renderRoadmapFromDb } from "../markdown-renderer.js";
-import { parseRoadmap } from "../parsers-legacy.js";
+import { renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "../markdown-renderer.js";
 import { isStaleWrite } from "../auto/turn-epoch.js";
-import { renderAllProjections } from "../workflow-projections.js";
+import { flushWorkflowProjections } from "../projection-flush.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning, logError } from "../workflow-logger.js";
@@ -56,9 +54,11 @@ function hasCompleteSliceArtifactContract(basePath, milestoneId, sliceId) {
         join(gsdProjectionRoot(basePath), "milestones", milestoneId, `${milestoneId}-ROADMAP.md`);
     if (!existsSync(roadmapPath))
         return false;
+    // Projection-completeness check (ADR-017): the DB has already recorded the
+    // duplicate completion; this only verifies the rendered markdown artifacts
+    // exist and reflect it, deciding whether re-rendering is needed.
     try {
-        const roadmap = parseRoadmap(readFileSync(roadmapPath, "utf-8"));
-        return roadmap.slices.some((slice) => slice.id === sliceId && slice.done);
+        return roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sliceId);
     }
     catch {
         return false;
@@ -289,58 +289,48 @@ export async function handleCompleteSlice(params, basePath) {
     // `npx playwright test` via gsd_uat_exec, and live-runtime/mixed/
     // browser-executable receive browser tools (UAT_MODE_POLICIES).
     const uatContent = params.uatContent || "";
-    const declaredUatMode = getDeclaredUatType(uatContent);
-    if (shouldEscalateArtifactUatToBrowser(uatContent)) {
+    const uatPolicy = classifyUatContent(uatContent);
+    if (escalatesArtifactUatToBrowser(uatPolicy)) {
+        // Distinguish an explicit artifact-driven declaration from a missing or
+        // unparseable one that merely *defaulted* to artifact-driven — telling an
+        // agent it "declared artifact-driven" when its declaration simply failed
+        // to parse sends it into a rewrite loop with the same unparseable format.
+        const staticOnlyClause = `which only runs static/file checks and would defer the browser work to a human`;
+        const modeClause = uatPolicy.modeDeclared
+            ? `declares "UAT mode: artifact-driven", ${staticOnlyClause}`
+            : `has no parseable UAT mode declaration in its "## UAT Type" section (the declaration must be a bullet exactly like "- UAT mode: browser-executable"), so it defaults to "artifact-driven", ${staticOnlyClause}`;
         return {
-            error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but declares "UAT mode: artifact-driven", which only runs static/file checks and would defer the browser work to a human. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
+            error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but ${modeClause}. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
         };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // ── Atomic completion cascade (guards + writes in one transaction) ───────
     const completedAt = new Date().toISOString();
     let guardError = null;
     let existingSummaryMd = "";
     let duplicateComplete = false;
-    transaction(() => {
-        // State machine preconditions (inside txn for atomicity).
-        // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
-        // Only block if they exist and are closed.
-        const milestone = getMilestone(params.milestoneId);
-        if (milestone && isClosedStatus(milestone.status)) {
-            guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-            return;
-        }
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
-        if (slice && isClosedStatus(slice.status)) {
-            duplicateComplete = true;
-            return;
-        }
-        // Verify all tasks are complete
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        if (tasks.length === 0) {
-            guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
-            return;
-        }
-        const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
-        if (incompleteTasks.length > 0) {
-            const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-            guardError = `incomplete tasks: ${incompleteIds}`;
-            return;
-        }
-        // All guards passed — perform writes. Preserve existing planning metadata:
-        // completion should not overwrite title/risk/depends/demo/sequence.
-        insertMilestone({ id: params.milestoneId, title: params.milestoneId });
-        if (!slice) {
-            insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceTitle || params.sliceId });
-        }
-        updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
-        const updatedSlices = getMilestoneSlices(params.milestoneId);
-        if (milestone?.status === "planned" &&
-            updatedSlices.length > 0 &&
-            updatedSlices.every((s) => isClosedStatus(s.status))) {
-            updateMilestoneStatus(params.milestoneId, "active");
-        }
+    const outcome = completeSliceCascade(params.milestoneId, params.sliceId, {
+        sliceTitle: params.sliceTitle,
+        completedAt,
     });
+    if (outcome.ok) {
+        existingSummaryMd = outcome.existingSummaryMd;
+        duplicateComplete = outcome.duplicate;
+    }
+    else {
+        switch (outcome.reason) {
+            case "milestone-closed":
+                guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})`;
+                break;
+            case "no-tasks":
+                guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+                break;
+            case "incomplete-tasks": {
+                const incompleteIds = outcome.incomplete.map((t) => `${t.id} (status: ${t.status})`).join(", ");
+                guardError = `incomplete tasks: ${incompleteIds}`;
+                break;
+            }
+        }
+    }
     if (duplicateComplete) {
         const staleSummaryPath = sliceSummaryPath(artifactBasePath, params.milestoneId, params.sliceId);
         const duplicateIsStale = isStaleWrite("complete-slice");
@@ -407,8 +397,9 @@ export async function handleCompleteSlice(params, basePath) {
         await saveFile(uatPath, uatMd);
         const roadmap = await renderRoadmapFromDb(artifactBasePath, params.milestoneId);
         clearParseCache();
-        const roadmapSlice = parseRoadmap(roadmap.content).slices.find((slice) => slice.id === params.sliceId);
-        if (!roadmapSlice?.done) {
+        // Render verification (ADR-017): confirms the just-written projection
+        // reflects the DB completion; the DB row is already committed.
+        if (!roadmapRenderMarksSliceDone(roadmap.content, params.sliceId)) {
             throw new Error(`roadmap render did not mark ${params.milestoneId}/${params.sliceId} complete`);
         }
     }
@@ -457,7 +448,7 @@ export async function handleCompleteSlice(params, basePath) {
     // Separate try/catch per step so a projection failure doesn't prevent
     // the event log entry (critical for worktree reconciliation).
     try {
-        await renderAllProjections(artifactBasePath, params.milestoneId);
+        await flushWorkflowProjections(artifactBasePath, { milestoneId: params.milestoneId });
     }
     catch (projErr) {
         logWarning("tool", `complete-slice projection warning for ${params.milestoneId}/${params.sliceId}: ${projErr.message}`);