gsd-pi 2.82.0 → 3.0.0-dev.04f5ccf82

package/src/resources/extensions/gsd/tests/native-git-bridge-exec-fallback.test.ts

@@ -13,17 +13,20 @@
 import { describe, test, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
 import { chmodSync, existsSync, mkdtempSync, writeFileSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
+import { delimiter, join } from "node:path";
 import { tmpdir } from "node:os";
 import { execFileSync } from "node:child_process";
 import {
   assertWorktreeMaterialized,
+  nativeBranchList,
   nativeBranchDelete,
   nativeCommit,
+  nativeGetCurrentBranch,
   nativeIsRepo,
   nativeResetHard,
   nativeWorktreeAdd,
 } from "../native-git-bridge.js";
+import { GIT_NO_PROMPT_ENV } from "../git-constants.js";
 
 // Note: prior static-analysis tests that scanned native-git-bridge.ts for
 // the raw shell-spawn pattern were removed under #4827 — the integration
@@ -78,6 +81,55 @@ describe("native-git-bridge #4180: fallback runtime behaviour", () => {
     assert.equal(subject, "test: regression commit #4180");
   });
 
+  test("nativeCommit retries once after transient ENOBUFS from git", (t) => {
+    const bin = mkdtempSync(join(tmpdir(), "ngb-enobufs-bin-"));
+    t.after(() => rmSync(bin, { recursive: true, force: true }));
+
+    const realGit = execFileSync("git", ["--exec-path"], { encoding: "utf-8" }).trim();
+    const attempts = join(bin, "attempts.txt");
+    const fakeGit = join(bin, "fake-git.cjs");
+    writeFileSync(fakeGit, `
+const { appendFileSync, readFileSync } = require("node:fs");
+const { spawnSync } = require("node:child_process");
+const attempts = ${JSON.stringify(attempts)};
+const realGit = ${JSON.stringify(join(realGit, process.platform === "win32" ? "git.exe" : "git"))};
+appendFileSync(attempts, "1");
+if (process.argv[2] === "commit" && readFileSync(attempts, "utf-8").length === 1) {
+  console.error("spawnSync git ENOBUFS");
+  process.exit(1);
+}
+const result = spawnSync(realGit, process.argv.slice(2), { stdio: "inherit" });
+process.exit(result.status ?? 1);
+`, "utf-8");
+
+    if (process.platform === "win32") {
+      writeFileSync(join(bin, "git.cmd"), `@echo off\r\nnode "${fakeGit}" %*\r\n`, "utf-8");
+    } else {
+      const shim = join(bin, "git");
+      writeFileSync(shim, `#!/bin/sh\nexec node "${fakeGit}" "$@"\n`, "utf-8");
+      chmodSync(shim, 0o755);
+    }
+
+    writeFileSync(join(repo, "file.txt"), "retry commit\n");
+    git(["add", "."], repo);
+
+    const originalPath = process.env.PATH ?? "";
+    const gitEnv = GIT_NO_PROMPT_ENV as NodeJS.ProcessEnv;
+    const originalGitEnvPath = gitEnv.PATH;
+    try {
+      process.env.PATH = `${bin}${delimiter}${originalPath}`;
+      gitEnv.PATH = process.env.PATH;
+      const result = nativeCommit(repo, "test: retry ENOBUFS commit");
+      assert.ok(result !== null, "commit should succeed after retry");
+    } finally {
+      process.env.PATH = originalPath;
+      gitEnv.PATH = originalGitEnvPath;
+    }
+
+    assert.equal(readFileSync(attempts, "utf-8").length, 2);
+    assert.equal(git(["log", "-1", "--format=%s"], repo), "test: retry ENOBUFS commit");
+  });
+
   test("nativeCommit runs commit hooks", () => {
     const hookPath = join(repo, ".git", "hooks", "commit-msg");
     const marker = join(repo, "hook-ran.txt");
@@ -119,7 +171,17 @@ describe("native-git-bridge #4180: fallback runtime behaviour", () => {
   test("nativeBranchDelete throws when git cannot delete the branch", () => {
     assert.throws(
       () => nativeBranchDelete(repo, "does-not-exist"),
-      /GSD_GIT_ERROR|git branch -D does-not-exist failed/,
+      /git branch -D does-not-exist failed[\s\S]*does-not-exist/,
+    );
+  });
+
+  test("nativeGetCurrentBranch preserves git stderr in fallback errors", (t) => {
+    const dir = mkdtempSync(join(tmpdir(), "ngb-stderr-notrepo-"));
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+
+    assert.throws(
+      () => nativeGetCurrentBranch(dir),
+      /git branch --show-current failed[\s\S]*(not a git repository|not a git repo|fatal:)/,
     );
   });
 
@@ -147,4 +209,20 @@ describe("native-git-bridge #4180: fallback runtime behaviour", () => {
       "created worktree must have the .git file required by later health checks",
     );
   });
+
+  test("nativeBranchList strips linked-worktree '+' marker from fallback output", (t) => {
+    const wtPath = join(repo, ".gsd", "worktrees", "M001");
+    t.after(() => {
+      try { git(["worktree", "remove", "--force", wtPath], repo); } catch { /* noop */ }
+    });
+
+    git(["branch", "milestone/M001"], repo);
+    git(["worktree", "add", wtPath, "milestone/M001"], repo);
+
+    const listed = nativeBranchList(repo, "milestone/*");
+    assert.ok(
+      listed.includes("milestone/M001"),
+      `expected clean milestone branch name, got: ${JSON.stringify(listed)}`,
+    );
+  });
 });

package/src/resources/extensions/gsd/tests/orphaned-worktree-audit.test.ts

@@ -243,7 +243,7 @@ describe("auditOrphanedMilestoneBranches", () => {
     );
   });
 
-  test("handles milestone in DB but no branch (no-op)", () => {
+  test("milestone in DB, no branch, no worktree dir → no-op", () => {
     insertMilestone({ id: "M001", title: "Test", status: "complete" });
 
     const result = auditOrphanedMilestoneBranches(dir, "worktree");
@@ -251,4 +251,124 @@ describe("auditOrphanedMilestoneBranches", () => {
     assert.deepStrictEqual(result.recovered, []);
     assert.deepStrictEqual(result.warnings, []);
   });
+
+  test("#5879 — cleans orphaned worktree dir for complete milestone whose branch was already deleted", () => {
+    // Reproduces the postflight-stash-restore-failed scenario:
+    // 1. An earlier audit deleted milestone/M001 (merged + complete).
+    // 2. The worktree dir cleanup failed silently (logWarning only).
+    // 3. On the next startup the branch is gone, so the existing branch-keyed
+    //    loop is invisible to the orphan dir. Without the second pass, the
+    //    directory lives forever.
+    insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "leftover.txt"), "stranded from a prior session\n");
+
+    // No milestone/M001 branch — already deleted on a previous run.
+    const branches = run("git branch --list milestone/M001", dir);
+    assert.equal(branches, "", "test fixture: branch should not exist");
+
+    const result = auditOrphanedMilestoneBranches(dir, "worktree");
+
+    assert.ok(
+      result.recovered.some((r) => r.includes("M001") && r.includes("branch already deleted")),
+      `should report branch-less orphan cleanup; got: ${JSON.stringify(result.recovered)}`,
+    );
+    assert.ok(!existsSync(wtDir), "branch-less orphan worktree dir should be removed");
+  });
+
+  test("#5879 — branch list failure still cleans complete orphan only after branch absence is verified", () => {
+    insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "leftover.txt"), "stranded from a prior session\n");
+
+    const result = auditOrphanedMilestoneBranches(dir, "worktree", {
+      branchList: () => {
+        throw new Error("branch list failed");
+      },
+      branchExists: (_basePath, branch) => {
+        assert.equal(branch, "milestone/M001");
+        return false;
+      },
+    });
+
+    assert.ok(
+      result.recovered.some((r) => r.includes("M001") && r.includes("branch already deleted")),
+      `should report verified branch-less orphan cleanup; got: ${JSON.stringify(result.recovered)}`,
+    );
+    assert.ok(!existsSync(wtDir), "verified branch-less orphan worktree dir should be removed");
+  });
+
+  test("#5879 — branch list failure preserves complete worktree when branch still exists", () => {
+    insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "live-work.txt"), "do not delete\n");
+
+    const result = auditOrphanedMilestoneBranches(dir, "worktree", {
+      branchList: () => {
+        throw new Error("branch list failed");
+      },
+      branchExists: (_basePath, branch) => {
+        assert.equal(branch, "milestone/M001");
+        return true;
+      },
+    });
+
+    assert.deepStrictEqual(result.recovered, []);
+    assert.ok(existsSync(wtDir), "worktree dir must be preserved when branch existence is verified");
+  });
+
+  test("#5879 — skips branch-less orphan for milestone that is not complete", () => {
+    // Defensive: only `complete` milestones get the branch-less cleanup. An
+    // `active` milestone with no branch but a worktree dir is a different
+    // state (probably mid-recovery) and should not be silently wiped.
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "live-work.txt"), "do not delete\n");
+
+    const result = auditOrphanedMilestoneBranches(dir, "worktree");
+
+    assert.deepStrictEqual(result.recovered, []);
+    assert.ok(existsSync(wtDir), "active milestone worktree dir must be preserved");
+  });
+
+  test("#5879 — branch list failure does not delete worktree for milestone that is not complete", () => {
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "live-work.txt"), "do not delete\n");
+
+    const result = auditOrphanedMilestoneBranches(dir, "worktree", {
+      branchList: () => {
+        throw new Error("branch list failed");
+      },
+      branchExists: () => {
+        throw new Error("branchExists should not be called for active milestones");
+      },
+    });
+
+    assert.deepStrictEqual(result.recovered, []);
+    assert.ok(existsSync(wtDir), "active milestone worktree dir must be preserved");
+  });
+
+  test("#5879 — skips branch-less orphan in 'none' isolation mode", () => {
+    insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+    const wtDir = join(dir, ".gsd", "worktrees", "M001");
+    mkdirSync(wtDir, { recursive: true });
+    writeFileSync(join(wtDir, "leftover.txt"), "stranded\n");
+
+    const result = auditOrphanedMilestoneBranches(dir, "none");
+
+    assert.deepStrictEqual(result.recovered, []);
+    assert.ok(existsSync(wtDir), "'none' mode must not touch worktree dirs");
+  });
 });

package/src/resources/extensions/gsd/tests/parallel-orchestrator-zombie-cleanup.test.ts

@@ -275,3 +275,58 @@ test("#2736: restoreRuntimeState clears stale state when all workers are stopped
   const stateFile = join(base, ".gsd", "orchestrator.json");
   assert.equal(existsSync(stateFile), false, "orchestrator.json should be removed");
 });
+
+test("#3428: refreshWorkerStatuses preserves terminal stopped state when disk status is missing", (t) => {
+  const base = makeTmpBase();
+  t.after(() => {
+    resetOrchestrator();
+    cleanup(base);
+  });
+
+  const persisted: PersistedState = {
+    active: true,
+    workers: [
+      {
+        milestoneId: "M001",
+        title: "Milestone 1",
+        pid: process.pid,
+        worktreePath: join(base, "worktrees", "M001"),
+        startedAt: Date.now() - 60_000,
+        state: "running",
+        cost: 0.4,
+      },
+      {
+        milestoneId: "M002",
+        title: "Milestone 2",
+        pid: process.pid,
+        worktreePath: join(base, "worktrees", "M002"),
+        startedAt: Date.now() - 60_000,
+        state: "running",
+        cost: 0.6,
+      },
+    ],
+    totalCost: 1.0,
+    startedAt: Date.now() - 60_000,
+    configSnapshot: { max_workers: 3 },
+  };
+  writePersistedState(base, persisted);
+
+  // Restore into memory first.
+  getWorkerStatuses(base);
+
+  // Simulate exit handler already marking the worker as stopped while session
+  // status file is missing and pid is dead.
+  const orchestrator = getOrchestratorState();
+  assert.ok(orchestrator, "orchestrator state should be restored");
+  const worker = orchestrator.workers.get("M001");
+  assert.ok(worker, "worker should exist");
+  worker.state = "stopped";
+  worker.pid = DEAD_PID;
+  writeSessionStatusFile(base, "M002", "running", process.pid);
+
+  refreshWorkerStatuses(base);
+
+  const refreshed = getOrchestratorState();
+  assert.ok(refreshed, "state should remain available for inspection");
+  assert.equal(refreshed.workers.get("M001")?.state, "stopped");
+});

package/src/resources/extensions/gsd/tests/park-db-sync.test.ts

@@ -7,7 +7,7 @@
  */
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -48,6 +48,60 @@ test("parkMilestone updates DB status to 'parked' (#2694)", () => {
   }
 });
 
+test("parkMilestone ignores blocked SUMMARY.md when DB milestone is active (#5828)", () => {
+  const base = createBase();
+  try {
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-SUMMARY.md"),
+      [
+        "---",
+        "status: closeout_blocked",
+        "---",
+        "",
+        "# M001 Summary",
+        "",
+        "Completion was not persisted.",
+      ].join("\n"),
+      "utf-8",
+    );
+
+    const parked = parkMilestone(base, "M001", "test");
+
+    assert.ok(parked, "active DB row should allow parking despite a blocked SUMMARY.md");
+    assert.ok(
+      existsSync(join(base, ".gsd", "milestones", "M001", "M001-PARKED.md")),
+      "PARKED.md should be written",
+    );
+    assert.equal(getMilestone("M001")!.status, "parked", "DB status should be parked");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+test("parkMilestone refuses DB-complete milestones (#5828)", () => {
+  const base = createBase();
+  try {
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+    const parked = parkMilestone(base, "M001", "test");
+
+    assert.equal(parked, false, "complete DB row should not be parkable");
+    assert.equal(
+      existsSync(join(base, ".gsd", "milestones", "M001", "M001-PARKED.md")),
+      false,
+      "PARKED.md should not be written",
+    );
+    assert.equal(getMilestone("M001")!.status, "complete", "DB status should remain complete");
+  } finally {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 test("unparkMilestone updates DB status to 'active' (#2694)", () => {
   const base = createBase();
   try {

package/src/resources/extensions/gsd/tests/pending-autostart-scope.test.ts

@@ -11,6 +11,7 @@ import {
   clearPendingAutoStart,
   _getPendingAutoStart,
 } from "../guided-flow.ts";
+import type { PendingAutoStartInput } from "../pending-auto-start.ts";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -20,6 +21,15 @@ function makeProjectDir(): string {
   return dir;
 }
 
+function pendingInput(basePath: string, milestoneId: string) {
+  return {
+    basePath,
+    milestoneId,
+    ctx: { ui: { notify: () => undefined } } as any,
+    pi: { sendMessage: () => undefined } as any,
+  };
+}
+
 // ─── Tests ───────────────────────────────────────────────────────────────────
 
 describe("pendingAutoStart scope pinning (C1)", () => {
@@ -38,7 +48,7 @@ describe("pendingAutoStart scope pinning (C1)", () => {
   });
 
   test("setPendingAutoStart stores a scope whose paths derive from the basePath at reservation time", () => {
-    setPendingAutoStart(base, { basePath: base, milestoneId: "M001" });
+    setPendingAutoStart(base, pendingInput(base, "M001"));
 
     const entry = _getPendingAutoStart(base);
     assert.ok(entry, "entry should exist");
@@ -54,8 +64,22 @@ describe("pendingAutoStart scope pinning (C1)", () => {
     assert.equal(entry.scope.stateFile(), expectedState);
   });
 
+  test("setPendingAutoStart rejects entries without ctx and pi before storing them", () => {
+    assert.throws(
+      () =>
+        setPendingAutoStart(base, {
+          basePath: base,
+          milestoneId: "M001",
+        } as PendingAutoStartInput),
+      /requires ctx and pi/,
+      "pending entries must include the handles later used by auto-start recovery",
+    );
+
+    assert.equal(_getPendingAutoStart(base), null);
+  });
+
   test("scope paths are unaffected by process.chdir after reservation", (t) => {
-    setPendingAutoStart(base, { basePath: base, milestoneId: "M002" });
+    setPendingAutoStart(base, pendingInput(base, "M002"));
 
     const entry = _getPendingAutoStart(base);
     assert.ok(entry, "entry should exist");
@@ -82,7 +106,7 @@ describe("pendingAutoStart scope pinning (C1)", () => {
 
   test("scope identityKey matches the realpath of the original basePath even with trailing slash", () => {
     const baseWithSlash = base + "/";
-    setPendingAutoStart(base, { basePath: baseWithSlash, milestoneId: "M003" });
+    setPendingAutoStart(base, pendingInput(baseWithSlash, "M003"));
 
     const entry = _getPendingAutoStart(base);
     assert.ok(entry, "entry should exist");
@@ -96,7 +120,7 @@ describe("pendingAutoStart scope pinning (C1)", () => {
   });
 
   test("clearPendingAutoStart removes the entry", () => {
-    setPendingAutoStart(base, { basePath: base, milestoneId: "M001" });
+    setPendingAutoStart(base, pendingInput(base, "M001"));
 
     const before = _getPendingAutoStart(base);
     assert.ok(before, "entry should exist before clear");
@@ -108,7 +132,7 @@ describe("pendingAutoStart scope pinning (C1)", () => {
   });
 
   test("_getPendingAutoStart with no basePath argument returns the sole entry", () => {
-    setPendingAutoStart(base, { basePath: base, milestoneId: "M001" });
+    setPendingAutoStart(base, pendingInput(base, "M001"));
 
     // No argument — should return the sole entry
     const entry = _getPendingAutoStart();

package/src/resources/extensions/gsd/tests/pipeline-variant-dispatch.test.ts

@@ -243,7 +243,8 @@ test("#4781 phase 2: validate-milestone rule writes pass-through VALIDATION for
   const content = readFileSync(validationPath, "utf-8");
   assert.match(content, /verdict: pass/);
   assert.match(content, /skip_validation: true/);
-  assert.match(content, /trivial-scope pipeline variant \(#4781\)/);
+  assert.match(content, /trivial-scope pipeline variant/);
+  assert.doesNotMatch(content, /#[0-9]{3,}/, "validation output must not include tracker-style refs");
 });
 
 test("#4781 phase 2: validate-milestone skip path does not persist gates without a real slice", async (t) => {

package/src/resources/extensions/gsd/tests/plan-milestone-sketch-render.test.ts

@@ -0,0 +1,157 @@
+// ADR-011 #5750: ROADMAP.md renders sketch slices with a `[sketch]` badge.
+//
+// Locks in the visual distinction so an auditor scanning the rendered roadmap
+// can tell which slices are sketches awaiting refine-slice expansion vs which
+// already carry a full plan. Sits alongside `plan-milestone.test.ts` which
+// covers the full-plan render path.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { openDatabase, closeDatabase } from "../gsd-db.ts";
+import { handlePlanMilestone, type PlanMilestoneParams } from "../tools/plan-milestone.ts";
+
+function makeTmpBase(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-plan-sketch-render-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  return base;
+}
+
+function cleanup(base: string): void {
+  try {
+    closeDatabase();
+  } catch {
+    /* noop */
+  }
+  try {
+    rmSync(base, { recursive: true, force: true });
+  } catch {
+    /* noop */
+  }
+}
+
+function planMilestoneWithSketches(): PlanMilestoneParams {
+  return {
+    milestoneId: "M001",
+    title: "Progressive Planning Demo",
+    vision: "Demonstrate sketch slices in ROADMAP rendering.",
+    successCriteria: ["S01 full, S02 sketch", "ROADMAP distinguishes them"],
+    keyRisks: [{ risk: "Visual collision", whyItMatters: "Auditors need to spot sketches." }],
+    proofStrategy: [{ riskOrUnknown: "Render correctness", retireIn: "S01", whatWillBeProven: "Roadmap shows the badge." }],
+    verificationContract: "Contract verification text",
+    verificationIntegration: "Integration verification text",
+    verificationOperational: "Operational verification text",
+    verificationUat: "UAT verification text",
+    definitionOfDone: ["Renderer emits badge", "Test asserts it"],
+    requirementCoverage: "Covers ADR-011 #5750.",
+    boundaryMapMarkdown: "| From | To | Produces | Consumes |\n|------|----|----------|----------|\n| S01 | S02 | scaffold | nothing |",
+    slices: [
+      {
+        sliceId: "S01",
+        title: "Fully planned scaffold",
+        risk: "medium" as const,
+        depends: [],
+        demo: "Scaffold is in place.",
+        goal: "Lay down the structural foundation.",
+        successCriteria: "Scaffold tests pass.",
+        proofLevel: "integration" as const,
+        integrationClosure: "Downstream slices depend on this scaffold.",
+        observabilityImpact: "No new telemetry.",
+        // No isSketch flag — defaults to full plan.
+      },
+      {
+        sliceId: "S02",
+        title: "Refinement candidate",
+        risk: "low" as const,
+        depends: ["S01"],
+        demo: "Sketched until S01 ships.",
+        goal: "Refine into a full plan after S01 lands.",
+        successCriteria: "",
+        proofLevel: "",
+        integrationClosure: "",
+        observabilityImpact: "",
+        isSketch: true,
+        sketchScope: "Pick up the scaffold from S01 and add the demo behavior. Stay inside the existing module boundaries.",
+      },
+    ],
+  };
+}
+
+test("ROADMAP renders sketch slices with [sketch] badge and full slices without", async () => {
+  const base = makeTmpBase();
+  try {
+    const params = planMilestoneWithSketches();
+    const result = await handlePlanMilestone(params, base);
+    if ("error" in result) {
+      assert.fail(`handlePlanMilestone failed: ${result.error}`);
+    }
+
+    const roadmapPath = join(base, ".gsd", "milestones", "M001", "M001-ROADMAP.md");
+    const roadmap = readFileSync(roadmapPath, "utf-8");
+
+    // S01 is a full slice — no sketch badge.
+    const s01Line = roadmap.split("\n").find((line) => line.includes("**S01:"));
+    assert.ok(s01Line, "S01 slice line must exist in roadmap");
+    assert.equal(
+      s01Line.includes("`[sketch]`"),
+      false,
+      "fully-planned S01 must NOT carry the sketch badge",
+    );
+    assert.match(s01Line, /`risk:medium`/);
+
+    // S02 is a sketch — badge required, positioned before risk.
+    const s02Line = roadmap.split("\n").find((line) => line.includes("**S02:"));
+    assert.ok(s02Line, "S02 slice line must exist in roadmap");
+    assert.ok(
+      s02Line.includes("`[sketch]`"),
+      `sketch slice S02 must carry the sketch badge, got: ${s02Line}`,
+    );
+    // Badge sits before risk so it stays visible if the line truncates.
+    const sketchIdx = s02Line.indexOf("`[sketch]`");
+    const riskIdx = s02Line.indexOf("`risk:");
+    assert.ok(
+      sketchIdx >= 0 && riskIdx >= 0 && sketchIdx < riskIdx,
+      "sketch badge must appear before the risk tag",
+    );
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("ROADMAP omits sketch badge when no slices are sketches", async () => {
+  const base = makeTmpBase();
+  try {
+    const params = planMilestoneWithSketches();
+    // Strip the sketch designation from S02 so both slices are fully planned.
+    params.slices[1] = {
+      ...params.slices[1],
+      isSketch: false,
+      successCriteria: "Demo behavior works.",
+      proofLevel: "unit" as const,
+      integrationClosure: "S02 closes the demo behavior.",
+      observabilityImpact: "No new telemetry.",
+    };
+
+    const result = await handlePlanMilestone(params, base);
+    if ("error" in result) {
+      assert.fail(`handlePlanMilestone failed: ${result.error}`);
+    }
+
+    const roadmap = readFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-ROADMAP.md"),
+      "utf-8",
+    );
+
+    assert.equal(
+      roadmap.includes("`[sketch]`"),
+      false,
+      "roadmap must not carry the sketch badge when no slice is a sketch",
+    );
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/plan-milestone.test.ts

@@ -116,6 +116,32 @@ test('handlePlanMilestone rejects invalid payloads', async () => {
   }
 });
 
+test('handlePlanMilestone rejects delimiter characters in milestone and slice titles', async () => {
+  const base = makeTmpBase();
+  const dbPath = join(base, '.gsd', 'gsd.db');
+  openDatabase(dbPath);
+
+  try {
+    const milestoneResult = await handlePlanMilestone({ ...validParams(), title: 'Client/Server split' }, base);
+    assert.ok('error' in milestoneResult);
+    assert.match(milestoneResult.error, /validation failed: title is invalid: .*forward slash/);
+    assert.equal(getMilestone('M001'), null, 'invalid milestone title must not persist');
+
+    const sliceResult = await handlePlanMilestone({
+      ...validParams(),
+      slices: [
+        validParams().slices[0],
+        { ...validParams().slices[1], title: 'Client/Server migration' },
+      ],
+    }, base);
+    assert.ok('error' in sliceResult);
+    assert.match(sliceResult.error, /validation failed: slices\[1\]\.title is invalid: .*forward slash/);
+    assert.equal(getMilestoneSlices('M001').length, 0, 'invalid slice title must not persist partial roadmap state');
+  } finally {
+    cleanup(base);
+  }
+});
+
 test('handlePlanMilestone surfaces render failures and does not clear parse-visible state on failure', async () => {
   const base = makeTmpBase();
   const dbPath = join(base, '.gsd', 'gsd.db');

package/src/resources/extensions/gsd/tests/plan-slice-prompt.test.ts

@@ -65,7 +65,9 @@ test("plan-slice prompt: DB-backed tool names survive template substitution", ()
   const result = loadPrompt("plan-slice", { ...BASE_VARS, commitInstruction: "Do not commit." });
   assert.ok(result.includes("gsd_plan_slice"), "gsd_plan_slice should appear in rendered prompt");
   assert.ok(result.includes("gsd_plan_task"), "gsd_plan_task should appear in rendered prompt");
+  assert.ok(result.includes("gsd_decision_save"), "structural decisions should use DB-backed decision tool");
   assert.ok(result.includes("canonical write path"), "canonical write path language should survive substitution");
+  assert.doesNotMatch(result, /append them to `.gsd\/DECISIONS\.md`/);
 });
 
 test("plan-slice prompt: compact planning gates survive template substitution", () => {