@opengsd/gsd-core 1.13.0 → 1.14.0

package/gsd-core/bin/lib/config-loader.cjs

@@ -135,6 +135,7 @@ const CONFIG_DEFAULTS = {
     firecrawl: _getConfigDefault('firecrawl'),
     exa_search: _getConfigDefault('exa_search'),
     text_mode: _getNestedConfigDefault('workflow', 'text_mode'),
+    compact_content: _getNestedConfigDefault('workflow', 'compact_content'),
     sub_repos: _getNestedConfigDefault('planning', 'sub_repos'),
     pr_strict: _getNestedConfigDefault('planning', 'pr_strict'),
     resolve_model_ids: _getConfigDefault('resolve_model_ids'),

package/gsd-core/bin/lib/config.cjs

@@ -81,6 +81,11 @@ const SCHEMA_DEFAULTS = {
     // #1689: per-plan agent_hint executor routing — default-on. A no-op for plans
     // without an agent_hint field, so existing dispatch is byte-identical.
     'workflow.agent_hint_routing': true,
+    // #4401: Compact Content mode gate — derived from the defaults manifest via
+    // CONFIG_DEFAULTS (added in config-loader.cts) so the manifest stays the
+    // single source of truth, matching workflow.smart_zone_tokens /
+    // planning.pr_strict / workflow.inline_plan_threshold below.
+    'workflow.compact_content': CONFIG_DEFAULTS.compact_content,
     // Derived from the defaults manifest rather than restated, so the manifest
     // stays the single source of truth for the smart-zone budget (#2630).
     'workflow.smart_zone_tokens': CONFIG_DEFAULTS.smart_zone_tokens,
@@ -93,6 +98,27 @@ const SCHEMA_DEFAULTS = {
     // effective default existed only as the workflow's shell fallback and the
     // docs disagreed (settings-advanced said 3). Manifest stays the one owner.
     'workflow.inline_plan_threshold': CONFIG_DEFAULTS.inline_plan_threshold,
+    // #4285 review: an absent threshold resolved to "Key not found" while the
+    // hook silently used 35/25 — the query surface disagreeing with the reader.
+    //
+    // Restated here rather than derived: `CONFIG_DEFAULTS` is re-exported with a
+    // FLATTENED shape that drops the manifest's nested blocks, so
+    // `CONFIG_DEFAULTS.hooks` is undefined at runtime and the manifest cannot
+    // feed these two rows the way `workflow.smart_zone_tokens` above is fed.
+    //
+    // Not added to `buildNewProjectConfig` either, and that one is deliberate
+    // rather than incidental: it writes a `hooks` object into every NEW project's
+    // config.json, which would freeze today's fire-points as an explicit
+    // per-project override everywhere — the opposite of this PR's premise that an
+    // absent key tracks the shipped default. (The manifest alone would NOT have
+    // that effect; `buildNewProjectConfig` builds its own literal. Correcting an
+    // earlier version of this comment that ran the two together.)
+    //
+    // That leaves ONE copy of 35/25 outside the hook — these two rows — and
+    // `tests/config.test.cjs` pins them against the hook's exported
+    // WARNING_THRESHOLD/CRITICAL_THRESHOLD so the copies cannot drift.
+    'hooks.context_warning_threshold': 35,
+    'hooks.context_critical_threshold': 25,
 };
 /**
  * Resolve a schema-level default for an absent key (#2256). Checks the legacy
@@ -308,6 +334,7 @@ function buildNewProjectConfig(userChoices) {
             human_verify_mode: 'end-of-phase',
             context_guard_mode: 'warn',
             text_mode: false,
+            compact_content: false,
             research_before_questions: false,
             discuss_mode: 'discuss',
             skip_discuss: false,
@@ -564,19 +591,35 @@ function _unsetNestedValue(config, keyPath) {
  * Does not call `output()`, so can be used as one step in a command without triggering `exit(0)` in
  * the happy path. But note that `error()` will still `exit(1)` out of the process.
  */
+/**
+ * Loads `.planning/config.json` as a plain object, or `{}` if the file does
+ * not exist. A parse failure calls `error()` (process-exiting) rather than
+ * throwing, matching every caller's existing behavior.
+ *
+ * Single source for this load+parse step — `setConfigValue`,
+ * `unsetConfigValue`, `setConfigValues`, `previewConfigValue`, and
+ * `previewUnsetConfigValue` all delegate here instead of each repeating the
+ * same try/catch (CLAUDE.md's "Generative Fix Divergence" known-defect
+ * pattern: independently-guessed copies of the same logic can silently
+ * drift apart).
+ */
+function loadConfigJson(cwd) {
+    const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
+    let config = {};
+    try {
+        if (node_fs_1.default.existsSync(configPath)) {
+            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        }
+    }
+    catch (err) {
+        error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
+    }
+    return config;
+}
 function unsetConfigValue(cwd, keyPath) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const { previousValue, existed } = _unsetNestedValue(config, keyPath);
         // Write back
         try {
@@ -598,16 +641,7 @@ function unsetConfigValue(cwd, keyPath) {
 function setConfigValue(cwd, keyPath, parsedValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const previousValue = _setNestedValue(config, keyPath, parsedValue);
         // Write back
         try {
@@ -619,6 +653,29 @@ function setConfigValue(cwd, keyPath, parsedValue) {
         }
     });
 }
+/**
+ * #4444: read-only preview counterpart to `setConfigValue` — loads config
+ * exactly like the real setter and reuses `_setNestedValue` (the SAME
+ * traversal/creation logic, including its prototype-pollution guards) on a
+ * throwaway in-memory copy that is NEVER written back to disk. This is what
+ * makes the dry-run preview provably identical to what the real write would
+ * compute, rather than a second, hand-maintained traversal that could drift
+ * from the real one.
+ */
+function previewConfigValue(cwd, keyPath, parsedValue) {
+    const config = loadConfigJson(cwd);
+    const previousValue = _setNestedValue(config, keyPath, parsedValue);
+    return { key: keyPath, value: parsedValue, previousValue };
+}
+/**
+ * #4444: read-only preview counterpart to `unsetConfigValue` — same pattern
+ * as `previewConfigValue`, reusing `_unsetNestedValue` on a throwaway copy.
+ */
+function previewUnsetConfigValue(cwd, keyPath) {
+    const config = loadConfigJson(cwd);
+    const { previousValue, existed } = _unsetNestedValue(config, keyPath);
+    return { key: keyPath, value: null, previousValue, existed };
+}
 /**
  * Batched sibling of setConfigValue: apply multiple key-path writes in a
  * single load → set-all → write cycle inside ONE withPlanningLock call.
@@ -635,16 +692,7 @@ function setConfigValues(cwd, entries) {
     }
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
     return withPlanningLock(cwd, () => {
-        // Load existing config or start with empty object
-        let config = {};
-        try {
-            if (node_fs_1.default.existsSync(configPath)) {
-                config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            }
-        }
-        catch (err) {
-            error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
-        }
+        const config = loadConfigJson(cwd);
         const results = [];
         for (const entry of entries) {
             const previousValue = _setNestedValue(config, entry.keyPath, entry.value);
@@ -676,14 +724,8 @@ function assertEnumValue(parsedValue, rawVal, allowed, label) {
         error(`Invalid ${label} '${rawVal}'. Valid values: ${allowed.join(', ')}`);
     }
 }
-/**
- * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
- * "workflow.research").
- *
- * Note that this exits the process (via `output()`) even in the happy path; use `setConfigValue()`
- * directly if you need to avoid this.
- */
-function cmdConfigSet(cwd, keyPath, value, raw) {
+function cmdConfigSet(cwd, keyPath, value, raw, options = {}) {
+    const dryRun = options.dryRun === true;
     if (!keyPath) {
         error('Usage: config-set <key.path> <value>', ERROR_REASON.USAGE);
     }
@@ -733,6 +775,18 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // present, truthy-adjacent value that consumers must special-case — worst for
     // secret keys where a leftover value can be passed as a real credential.
     if (parsedValue === null) {
+        if (dryRun) {
+            const preview = previewUnsetConfigValue(cwd, kp);
+            if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+                const maskedPrev = preview.previousValue === undefined
+                    ? undefined
+                    : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+                output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: maskedPrev, masked: true }, raw, `${kp} unset (dry run)`);
+                return;
+            }
+            output({ dry_run: true, would_unset: true, key: kp, value: null, previousValue: preview.previousValue }, raw, `${kp} unset (dry run)`);
+            return;
+        }
         const unsetResult = unsetConfigValue(cwd, kp);
         if ((0, secrets_cjs_1.isSecretKey)(kp)) {
             const maskedPrev = unsetResult.previousValue === undefined
@@ -787,6 +841,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Compact Content mode gate (#4139)
+    if (kp === 'workflow.compact_content') {
+        if (typeof parsedValue !== 'boolean') {
+            error(`Invalid workflow.compact_content '${val}'. Must be a boolean (true or false).`);
+        }
+    }
     // Per-plan executor routing via agent_hint frontmatter (#1689)
     if (kp === 'workflow.agent_hint_routing') {
         if (typeof parsedValue !== 'boolean') {
@@ -835,6 +895,48 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid statusline.show_git '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Context-monitor fire-points (#4285) — a percentage of the context window
+    // REMAINING, so the domain is 0-100 and the hook compares them against
+    // `remaining_percentage`. Rejecting an out-of-domain value here keeps accept
+    // and honour in agreement ON THE DOMAIN: the hook falls back to its default
+    // for a value outside it, so reporting success would be a lie. That agreement
+    // is per-key and no wider — a value accepted here can still be superseded at
+    // read time by the hook's pair check, and a scoped write (GSD_PROJECT /
+    // GSD_WORKSTREAM) lands in a config the hook does not read at all. The PAIR
+    // (critical < warning) is deliberately NOT enforced here: config-set writes
+    // one key per call, so a two-step retune can be transiently inconsistent on
+    // disk and a check here would reject that intermediate write.
+    if (kp === 'hooks.context_warning_threshold' || kp === 'hooks.context_critical_threshold') {
+        if (typeof parsedValue !== 'number' || !Number.isFinite(parsedValue) || parsedValue < 0 || parsedValue > 100) {
+            error(`Invalid ${kp} '${val}'. Must be a number between 0 and 100 (percent of context window remaining).`);
+        }
+        // The two ENDPOINTS that are in range but can never form a valid pair are
+        // refused here rather than stored (#4285 review). `critical < warning` must
+        // hold at read time and BOTH sides are clamped to 0-100, so `warning: 0`
+        // has no legal partner (nothing is below 0) and `critical: 100` has none
+        // either (nothing above 100). Either one is silently discarded by the hook
+        // for EVERY value of the other key — verified: both resolve to the 35/25
+        // defaults against a present, absent, or extreme partner, while 0.001 and
+        // 99.999 are honoured.
+        //
+        // Storing a value the reader can never honour is exactly the
+        // accept-then-discard shape this codebase refuses elsewhere, so this fails
+        // at write time where the operator can see it. The pair itself is still NOT
+        // checked here — config-set writes one key per call, so a two-step retune
+        // is legitimately inconsistent on disk in between.
+        if (kp === 'hooks.context_warning_threshold' && parsedValue === 0) {
+            error(`Invalid ${kp} '${val}'. 0 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `critical value is below 0, so a warning of 0 would always fall back to the 35/25 `
+                + `defaults. Use a value above 0.`);
+        }
+        if (kp === 'hooks.context_critical_threshold' && parsedValue === 100) {
+            error(`Invalid ${kp} '${val}'. 100 is in range but unusable: the monitor requires `
+                + `hooks.context_critical_threshold < hooks.context_warning_threshold, and no valid `
+                + `warning value is above 100, so a critical of 100 would always fall back to the `
+                + `35/25 defaults. Use a value below 100.`);
+        }
+    }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
     if (kp === 'code_quality.fallow.scope')
@@ -921,6 +1023,19 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             }
         }
     }
+    if (dryRun) {
+        const preview = previewConfigValue(cwd, kp, parsedValue);
+        if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+            const masked = (0, secrets_cjs_1.maskSecret)(parsedValue);
+            const maskedPrev = preview.previousValue === undefined
+                ? undefined
+                : (0, secrets_cjs_1.maskSecret)(preview.previousValue);
+            output({ dry_run: true, would_update: true, key: kp, value: masked, previousValue: maskedPrev, masked: true }, raw, `${kp}=${masked} (dry run)`);
+            return;
+        }
+        output({ dry_run: true, would_update: true, key: kp, value: parsedValue, previousValue: preview.previousValue }, raw, `${kp}=${String(parsedValue)} (dry run)`);
+        return;
+    }
     const setConfigValueResult = setConfigValue(cwd, kp, parsedValue);
     // Mask secrets in both JSON and text output. The plaintext is written
     // to config.json (that's where secrets live on disk); the CLI output

package/gsd-core/bin/lib/coverage.cjs

@@ -435,7 +435,7 @@ function cmdClassify(cwd, options = {}, raw) {
     }
     let resolvedPath;
     try {
-        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', { allowAbsolute: true });
+        resolvedPath = (0, security_cjs_1.requireSafePath)(filePath, cwd, 'SUMMARY file', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
     }
     catch (e) {
         // Emit a structured command error instead of leaking a raw stack trace.

package/gsd-core/bin/lib/decisions.cjs

@@ -5,7 +5,9 @@
  * truth). Behaviour is preserved byte-for-behaviour from the prior hand-written
  * .cjs; only types are added.
  *
- * Accepts both numeric (D-42) and alphanumeric (D-INFRA-01) IDs.
+ * Accepts numeric (D-42), alphanumeric (D-INFRA-01), and phase-prefixed
+ * (D4-01 — an optional digit-run between the leading letter and the hyphen,
+ * #4130) IDs.
  * Returns {id, text, category, tags, trackable} per decision.
  * CJS callers that only use {id, text} safely ignore the extra fields.
  *
@@ -16,6 +18,11 @@
  * - Outer bullet loop → seam's `iterateBullets` (for the header-fallback path)
  *
  * Resolves #1364 (markdown-header + em-dash recall) and #1365 (fail-loud gate).
+ *
+ * #4130 follow-up (hardening): the three bullet grammars below consume the
+ * decision ID atomically and narrow the em-dash first separator, eliminating
+ * the quadratic-backtracking cliff on pathological single bullets. Output is
+ * byte-identical on all legal inputs — see the notes at DECISION_ID_SOURCE.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractDecisions = extractDecisions;
@@ -30,21 +37,84 @@ const DISCRETION_HEADINGS = new Set([
 const NON_TRACKABLE_TAGS = new Set(['informational', 'folded', 'deferred']);
 // ─── Bullet parsers (decisions-specific grammar) ─────────────────────────────
 /**
- * Colon form: `- **D-NN[ [tags]]:** text`
+ * #4130: the ID grammar every extractor regex below shares, as ONE source.
+ * `D`, an OPTIONAL digit-run phase prefix, a hyphen, then the pre-existing
+ * alphanumeric tail — so `D-01` (bare), `D4-01`/`D12-01` (phase-prefixed,
+ * the reporter's multi-phase convention where bare D-01 collides across
+ * phases), and `D-INFRA-01` (alnum tail) are all the same grammar now.
+ * #2347 had already taught the shape DETECTOR to call `D4-01` decision-shaped
+ * while the EXTRACTOR still anchored on the literal `**D-` — the disagreement
+ * that made a whole phase-prefixed CONTEXT.md report could-not-parse. Deriving
+ * the three grammars (and the token evidence below) from this one constant is
+ * the parity pin: the extractor's ID universe cannot drift from the declared
+ * grammar again without editing this line, which the #4130 property tests
+ * watch from the other side.
+ */
+const DECISION_ID_SOURCE = 'D[0-9]*-[A-Za-z0-9][A-Za-z0-9_-]*';
+/**
+ * #4130 follow-up (hardening): how the three grammars below CONSUME the ID —
+ * atomically, via the `(?=(X))\1` lookahead emulation (lookarounds are atomic
+ * in ECMAScript; the backreference must replay exactly what the lookahead
+ * captured, so the engine can never give the ID tail back one character at a
+ * time). That give-back was quadratic driver #1: the tail class
+ * `[A-Za-z0-9_-]*` overlaps the pre-separator class `[^:*]*` (every id char
+ * is also `[^:*]`), so on a FAILING bullet the base regex re-split the tail
+ * O(n) times with an O(n) scan after each — measured ~1.1s @ 40k chars on
+ * `- **D-` + `a-`×20k (the #4357 review's deferred cliff).
+ *
+ * Byte-identical on all legal inputs: a successful match always consumes the
+ * MAXIMAL id run (the lookahead's own match is exactly that maximal run), and
+ * the continuation's success depends only on the position of the first
+ * `:`/`*` (or `*` for the em-dash form) after the id boundary — id chars
+ * contain neither, so moving the boundary inside the run cannot change
+ * success or any capture. Group 1 stays the full id (the lookahead's capture
+ * IS group 1), so handlers keep reading match[1]/[2]/[3] untouched. Pinned by
+ * the differential property test against a frozen copy of the pre-hardening
+ * grammars and by the regex-lattice test in tests/decisions.test.cjs.
+ */
+/**
+ * #4130: the bold lead-in that ATTEMPTS the ID grammar above — used by the
+ * parse-miss guard and the #3939 join regexes, where recognising MORE shapes
+ * is the conservative direction (an over-broad match can only make a
+ * malformed bullet fail loud). The prefix run is either empty (bare `D-`) or
+ * DIGIT-INITIAL (`4`, `4x` — a phase prefix with a typo still counts as an
+ * attempted ID, so `D4x-01` reaches the guard and fails loud instead of
+ * vanishing), but never letter-initial: `D` + letters + `-` (`Deferred-until`)
+ * is a prose word, and prose must stay `none-present` (#2347's law).
+ */
+const ID_ATTEMPT_SOURCE = 'D(?:[0-9][A-Za-z0-9]*)?-';
+/**
+ * Colon form: `- **D[phase]-NN[ [tags]]:** text`
  * (#1343: `[^:*]*` subsumes any pre-colon prose, stops at `:**`)
+ * Group 1 captures the FULL id including any phase prefix (#4130).
+ * The ID is consumed atomically `(?=(…))\1` — see the hardening note above
+ * the constants (#4130 follow-up); with the tail unable to give back, the
+ * remaining `[^:*]*:` scan has a single viable split and the whole match is
+ * linear in line length.
  */
-const bulletColonRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^:*]*:\*\*\s*(.*)$/;
+const bulletColonRe = new RegExp(`^\\s*-\\s+\\*\\*(?=(${DECISION_ID_SOURCE}))\\1(?:\\s*\\[([^\\]]+)\\])?[^:*]*:\\*\\*\\s*(.*)$`);
 /**
- * Em-dash form: `- **D-NN[ [tags]] — title** body`
+ * Em-dash form: `- **D[phase]-NN[ [tags]] — title** body`
  * The em-dash (U+2014) or its lookalike separates the ID+tags group from a title
  * that lives inside the bold markers; the body (which may be empty) follows
  * outside the closing `**`. This form was not handled pre-T1 (bug #1364).
  *
  * Accepts both U+2014 em-dash (—) and U+2013 en-dash (–) for robustness.
+ *
+ * #4130 follow-up (hardening), quadratic driver #2: the first separator was
+ * `[^*]*[—–]`, whose leading class ALSO accepts the dash — on a failing
+ * dash-laden title the engine retried the separator at every dash position
+ * with an O(n) scan after each (~1.7s @ 40k). Narrowed to `[^*—–]*[—–]`:
+ * the leading class now excludes the dash, so the separator is the FIRST
+ * dash — one viable split, single pass. Behavior-preserving because every
+ * candidate dash lies before the first `*` (the leading class cannot cross
+ * a star), so the trailing `[^*]*` reaches that same first star from any
+ * candidate and `**` succeeds or fails identically; no capture involves the
+ * dash position. The ID is atomic like the other forms (driver #1).
  */
-const bulletEmDashRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^*]*[—–][^*]*\*\*\s*(.*)$/;
+const bulletEmDashRe = new RegExp(`^\\s*-\\s+\\*\\*(?=(${DECISION_ID_SOURCE}))\\1(?:\\s*\\[([^\\]]+)\\])?[^*—–]*[—–][^*]*\\*\\*\\s*(.*)$`);
 /**
- * Titled-colon form: `- **D-NN[ [tags]]: Title.** body`
+ * Titled-colon form: `- **D[phase]-NN[ [tags]]: Title.** body`
  * A title sits between the colon and the closing `**` (so the `:**` anchor of
  * bulletColonRe fails, and there is no em-dash for bulletEmDashRe). This is a strict
  * superset of the colon-immediate form, so it MUST be checked AFTER bulletColonRe and
@@ -53,16 +123,34 @@ const bulletEmDashRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+
  * (e.g. `D-07 ratio 3:1:**`) still fails the anchor and falls through to the parse-miss
  * guard — matching bulletColonRe's `[^:*]*` discipline that the separator colon is the
  * only colon permitted before `**`. (#1639)
+ *
+ * The ID is consumed atomically `(?=(…))\1` like the other forms — the
+ * hardening note above the constants explains why (#4130 follow-up).
+ */
+const bulletTitledColonRe = new RegExp(`^\\s*-\\s+\\*\\*(?=(${DECISION_ID_SOURCE}))\\1(?:\\s*\\[([^\\]]+)\\])?[^:*]*:[^:*]*\\*\\*\\s*(.*)$`);
+/**
+ * #4130: the parse-miss guard's probe — a line whose bold lead-in ATTEMPTS the
+ * ID grammar (see `ID_ATTEMPT_SOURCE`) but failed all three bullet patterns
+ * above. Bare `D-` attempts behave exactly as before #4130; a digit-initial
+ * prefix run (`D4-`… including a typo'd `D4x-`) is new evidence of an attempt,
+ * so the malformed-prefixed bullet fails loud instead of silently vanishing.
  */
-const bulletTitledColonRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^:*]*:[^:*]*\*\*\s*(.*)$/;
+const parseMissGuardRe = new RegExp(`^\\s*-\\s+\\*\\*${ID_ATTEMPT_SOURCE}`);
+/**
+ * #4130: bare-token evidence of decision-shaped content — a `D…-<alnum>` token
+ * in running text. `D-01` matched before; the digit-run phase prefix (`D4-01`)
+ * is added so token evidence agrees with the extractor's ID grammar
+ * (DECISION_ID_SOURCE) instead of silently ignoring prefixed mentions.
+ */
+const decisionTokenRe = new RegExp(`\\bD[0-9]*-[A-Za-z0-9]`, 'm');
 /**
  * #2347: format-agnostic evidence that a block/section holds real decision
  * ENTRIES the parser could not read — a bullet whose bold lead-in is an
  * ID-SHAPED token (uppercase prefix, optional digits, hyphen, alnum), whatever
- * the exact ID grammar. The three parser grammars above all require a `D-`
- * prefix; #1365's fail-loud guard reused that same `\bD-` test as its "is this
- * decision-shaped?" evidence, so any other prefix (e.g. `D5-01`) was invisible
- * to BOTH parser and guard, collapsing `could-not-parse` into a clean
+ * the exact ID grammar. #1365's fail-loud guard originally reused the parser's
+ * own `\bD-` test as its "is this decision-shaped?" evidence, so any prefix the
+ * parser could not read (e.g. `D5-01` then, `DEC-01` now) was invisible to
+ * BOTH parser and guard, collapsing `could-not-parse` into a clean
  * `none-present` pass.
  *
  * The ID-shape requirement (not "any bold bullet") is deliberate: a decisions
@@ -70,25 +158,35 @@ const bulletTitledColonRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([
  * bullets with bold labels (`- **Scope:** …`, `- **Why:** …`, `- **Note:** …`).
  * Those are NOT decision entries and must stay `none-present` — a false
  * `could-not-parse` hard-blocks the plan gate. `[A-Z]+[0-9]*-[A-Za-z0-9]` matches
- * `D-01` / `D5-01` / `DEC-01` but not `Scope:` / `Why:` / `Follow-up:` (mixed
+ * `D-01` / `D4-01` / `DEC-01` but not `Scope:` / `Why:` / `Follow-up:` (mixed
  * case) / `TODO:` (no `-<alnum>` id) — mirroring the parser's own `D-<alnum>`
  * shape without hardcoding the `D`.
+ *
+ * #4130 parity note: for the D-prefixed universe this detector's grammar
+ * (`D` + digit-run + `-` + alnum) is exactly `DECISION_ID_SOURCE` above, so a
+ * well-formed bullet the detector calls decision-shaped is now always one the
+ * extractor can read. The detector stays WIDER on purpose (`DEC-01` is still
+ * evidence): an ID grammar outside the parser's universe must keep failing
+ * loud, never silently passing. The #4130 property tests pin both directions.
  */
 const boldLeadInBulletRe = /^\s*-\s+\*\*[A-Z]+[0-9]*-[A-Za-z0-9]/m;
 /**
- * #3939: a decision bullet's DECLARATION line — the `- **D-NN … **` bold lead-in
- * the three grammars above anchor on — may wrap across a line break. Physical
- * line breaks inside a bullet are markdown-insignificant, and GSD's own
+ * #3939: a decision bullet's DECLARATION line — the `- **D[phase]-NN … **` bold
+ * lead-in the three grammars above anchor on — may wrap across a line break.
+ * Physical line breaks inside a bullet are markdown-insignificant, and GSD's own
  * discuss-phase writer emits the wrapped shape whenever a decision title runs
  * past the wrap column. All three grammars require the closing `**` in the same
- * string as the `- **D-` anchor, so a wrapped declaration matched none of them
+ * string as the `- **D…-` anchor, so a wrapped declaration matched none of them
  * and fell to the #1365 parse-miss guard, forcing `could-not-parse` (which
  * hard-blocks `check.decision-coverage-plan`) on a well-formed CONTEXT.md.
  *
  * The repair is confined to how the LOGICAL bullet is assembled — the grammars
  * themselves are untouched, so every single-line form parses exactly as before.
+ * #4130: the anchor uses `ID_ATTEMPT_SOURCE` (digit-run phase prefixes join
+ * like bare ones; recognising more start shapes only reassembles the logical
+ * bullet, which then parses or fails loud as itself).
  */
-const decisionBulletStartRe = /^\s*-\s+\*\*D-/;
+const decisionBulletStartRe = new RegExp(`^\\s*-\\s+\\*\\*${ID_ATTEMPT_SOURCE}`);
 /**
  * A line that opens a new BLOCK-LEVEL construct, and therefore terminates the
  * bullet above it: a list marker of any family (`-`, `*`, `+`, `1.`, `1)`), an
@@ -136,7 +234,8 @@ const blockConstructRe = /^(?:[-*+]\s|\d+[.)]\s|#{1,6}\s|>\s|\|)/;
  * to watch for a splice.
  *
  * The id character class is deliberately looser than the grammars' (it admits
- * an empty id, so a bare `- **D-` still counts as unsettled). This regex only
+ * an empty id, so a bare `- **D-` still counts as unsettled, and — #4130 — a
+ * digit-run phase prefix between the `D` and the first hyphen). This regex only
  * answers "may an id-adjacent bracket still open here?", where recognising MORE
  * shapes is the conservative direction: an over-broad match can only make a
  * malformed bullet fail loud, while a missed one silently re-classifies.
@@ -145,7 +244,7 @@ const blockConstructRe = /^(?:[-*+]\s|\d+[.)]\s|#{1,6}\s|>\s|\|)/;
  * into `tags` (and therefore into `trackable`). A `[` further along the title is
  * ordinary text and does not restrict the join.
  */
-const tagRegionRe = /^\s*-\s+\*\*D-[A-Za-z0-9_-]*\s*(?:\[([^\]]*))?$/;
+const tagRegionRe = new RegExp(`^\\s*-\\s+\\*\\*D[0-9]*-[A-Za-z0-9_-]*\\s*(?:\\[([^\\]]*))?$`);
 /**
  * #3939 (review): would folding `next` onto a lead-in whose `[tags]` bracket is
  * still open splice the inserted space INTO a tag token?
@@ -347,11 +446,11 @@ function parseDecisionLines(block) {
             current.text += ' ' + trimmed;
             continue;
         }
-        // Colon form: `- **D-NN[ [tags]]:** text`
+        // Colon form: `- **D[phase]-NN[ [tags]]:** text`
         const colonMatch = line.match(bulletColonRe);
         if (colonMatch) {
             flush();
-            const id = `D-${colonMatch[1]}`;
+            const id = colonMatch[1];
             const tags = colonMatch[2]
                 ? colonMatch[2].split(',').map((t) => t.trim().toLowerCase()).filter(Boolean)
                 : [];
@@ -360,11 +459,11 @@ function parseDecisionLines(block) {
             openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
-        // Em-dash form: `- **D-NN[ [tags]] — title** body`
+        // Em-dash form: `- **D[phase]-NN[ [tags]] — title** body`
         const emDashMatch = line.match(bulletEmDashRe);
         if (emDashMatch) {
             flush();
-            const id = `D-${emDashMatch[1]}`;
+            const id = emDashMatch[1];
             const tags = emDashMatch[2]
                 ? emDashMatch[2].split(',').map((t) => t.trim().toLowerCase()).filter(Boolean)
                 : [];
@@ -376,14 +475,14 @@ function parseDecisionLines(block) {
             openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
-        // Titled-colon form: `- **D-NN[ [tags]]: Title.** body` (#1639). Checked LAST — it is
+        // Titled-colon form: `- **D[phase]-NN[ [tags]]: Title.** body` (#1639). Checked LAST — it is
         // a strict superset of bulletColonRe, so it only catches bullets the colon-immediate
         // and em-dash forms missed (minimal blast radius). id + [tags] trackability honored;
         // the body after the closing bold run is reported as text.
         const titledColonMatch = line.match(bulletTitledColonRe);
         if (titledColonMatch) {
             flush();
-            const id = `D-${titledColonMatch[1]}`;
+            const id = titledColonMatch[1];
             const tags = titledColonMatch[2]
                 ? titledColonMatch[2].split(',').map((t) => t.trim().toLowerCase()).filter(Boolean)
                 : [];
@@ -392,10 +491,14 @@ function parseDecisionLines(block) {
             openIndent = (0, token_scanner_cjs_1.indentWidth)(line);
             continue;
         }
-        // Parse-miss guard (FIX B + #1343): a line that looks like a `D-NN` decision
-        // bullet but failed both patterns — flush, warn, and record the miss.
+        // Parse-miss guard (FIX B + #1343, grammar widened #4130): a line whose bold
+        // lead-in ATTEMPTS the ID grammar but failed all three patterns — flush,
+        // warn, and record the miss. `ID_ATTEMPT_SOURCE` accepts the bare `D-` form
+        // (as before) plus a digit-initial prefix run, so a typo'd phase prefix
+        // (`D4x-01`) fails loud instead of silently vanishing, while a letter-initial
+        // run (`Deferred-until`) stays prose and stays invisible.
         // parseMisses > 0 forces could-not-parse even when other decisions parsed.
-        if (/^\s*-\s+\*\*D-/.test(line)) {
+        if (parseMissGuardRe.test(line)) {
             flush();
             parseMisses += 1;
             console.warn(`parseDecisions: ignored unparseable decision bullet: ${trimmed}`);
@@ -449,10 +552,10 @@ function extractDecisions(content) {
         // FIX A: Block present but 0 extracted and no parse-misses.
         // Only report could-not-parse when there is genuine evidence of real decisions
         // that failed to parse: a bold-lead-in bullet (`- **…**`, any ID grammar — #2347),
-        // a \bD- token in the block text, or an unterminated fence. An empty scaffold
+        // a bare `D[phase]-<alnum>` token (#4130) in the block text, or an unterminated fence. An empty scaffold
         // (<decisions></decisions>) or an all-prose block has no such evidence — treat
         // as none-present so the gate passes cleanly.
-        const hasDecisionTokenInBlock = /\bD-[A-Za-z0-9]/m.test(combined);
+        const hasDecisionTokenInBlock = decisionTokenRe.test(combined);
         const hasBoldLeadInBullet = boldLeadInBulletRe.test(combined);
         if (hasDecisionTokenInBlock || hasBoldLeadInBullet || unterminatedFence) {
             return { decisions: [], outcome: 'could-not-parse' };
@@ -475,10 +578,10 @@ function extractDecisions(content) {
         }
         // FIX A: Heading found but 0 extracted and no parse-misses.
         // Report could-not-parse when the section body holds a decision-entry-shaped
-        // bold-lead-in bullet (`- **…**`, any ID grammar — #2347) or a D- token. A
+        // bold-lead-in bullet (`- **…**`, any ID grammar — #2347) or a `D[phase]-<alnum>` token (#4130). A
         // heading with only prose, sub-headings, or all-discretion content (no such
         // evidence) is a legitimate empty/discretion section → none-present.
-        const hasDecisionTokenInSection = /\bD-[A-Za-z0-9]/m.test(section.body);
+        const hasDecisionTokenInSection = decisionTokenRe.test(section.body);
         const hasBoldLeadInBulletInSection = boldLeadInBulletRe.test(section.body);
         if (hasDecisionTokenInSection || hasBoldLeadInBulletInSection) {
             return { decisions: [], outcome: 'could-not-parse' };
@@ -487,8 +590,8 @@ function extractDecisions(content) {
     }
     // ── Path 3: no blocks, no heading ────────────────────────────────────────────
     // Apply shape heuristics to distinguish none-present from could-not-parse.
-    // We re-use the already-computed unterminatedFence and check for D- tokens.
-    const hasDecisionToken = /\bD-[A-Za-z0-9]/m.test(stripped);
+    // We re-use the already-computed unterminatedFence and check for decision tokens.
+    const hasDecisionToken = decisionTokenRe.test(stripped);
     if (unterminatedFence || hasDecisionToken) {
         return { decisions: [], outcome: 'could-not-parse' };
     }