cmdPhaseComplete and cmdPhasesRemove read STATE.md outside the lock then wrote inside. A crash between the ROADMAP update (locked) and the STATE write left them inconsistent. Wrap both STATE.md updates in readModifyWriteStateMd to hold the lock across read-modify-write. Also exports readModifyWriteStateMd from state.cjs for cross-module use. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>