@opengsd/gsd-core 1.7.0 → 1.8.0

package/gsd-core/bin/lib/commands.cjs

@@ -33,7 +33,10 @@ const roadmapParserMod = require("./roadmap-parser.cjs");
 const { extractCurrentMilestone, stripShippedMilestones: _stripShippedMilestones, getMilestoneInfo, getMilestonePhaseFilter, getRoadmapPhaseInternal } = roadmapParserMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const modelResolverMod = require("./model-resolver.cjs");
-const { resolveModelInternal, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, resolveGranularityInternal, assertValidGranularityOverride } = modelResolverMod;
+const { resolveModelInternal, resolveModelForTier, resolveProviderEscalation, resolveEffortInternal, resolveFastModeInternal, resolveEffortForTier, resolveGranularityInternal, assertValidGranularityOverride } = modelResolverMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const agentCommandRouterMod = require("./agent-command-router.cjs");
+const { AGENT_FAILURE_CLASSES } = agentCommandRouterMod;
 const model_catalog_cjs_1 = require("./model-catalog.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -47,6 +50,44 @@ const { MODEL_PROFILES, VALID_PHASE_TYPES } = modelProfiles;
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 const clock_cjs_1 = require("./clock.cjs");
 // ─── Phase Status ─────────────────────────────────────────────────────────────
+/**
+ * Phase-status precedence ladder — furthest-along wins (#2408).
+ *
+ * `cmdStats` builds `phasesByNumber` by scanning on-disk phase directories.
+ * When two directories normalize to the same phase key (e.g. `05-real/` and
+ * `05-real-stray/`), the status field must be folded by precedence rather
+ * than overwritten last-write-wins — otherwise `/gsd-stats` reports whatever
+ * directory `fs.readdirSync` happened to yield last, which is non-deterministic
+ * across platforms and can silently call a `Complete` phase `Not Started`.
+ */
+const PHASE_STATUS_PRECEDENCE = [
+    'Complete',
+    'Needs Review',
+    'Executed',
+    'In Progress',
+    'Planned',
+    'Not Started',
+    'Pending',
+];
+const PHASE_STATUS_RANK = new Map(PHASE_STATUS_PRECEDENCE.map((s, i) => [s, i]));
+/**
+ * Fold two phase statuses by precedence — returns whichever is further along
+ * the {@link PHASE_STATUS_PRECEDENCE} ladder. Unrecognized statuses fall behind
+ * every recognized one (so a recognized status always wins over an unknown one;
+ * two unrecognized statuses favor `a` for determinism).
+ */
+function foldPhaseStatus(a, b) {
+    const ra = PHASE_STATUS_RANK.get(a);
+    const rb = PHASE_STATUS_RANK.get(b);
+    if (ra === undefined && rb === undefined)
+        return a;
+    if (ra === undefined)
+        return b;
+    if (rb === undefined)
+        return a;
+    // Lower rank = higher precedence (Complete=0 wins over Not Started=5).
+    return ra <= rb ? a : b;
+}
 /**
  * Determine phase status by checking plan/summary counts AND verification state.
  * Introduces "Executed" for phases with all summaries but no passing verification.
@@ -128,6 +169,9 @@ function cmdListTodos(cwd, area, raw) {
             const createdMatch = content.match(/^created:\s*(.+)$/m);
             const titleMatch = content.match(/^title:\s*(.+)$/m);
             const areaMatch = content.match(/^area:\s*(.+)$/m);
+            // #2337: surface severity when present. Omit the key entirely for todos
+            // with no severity line so existing consumers of this JSON are unaffected.
+            const severityMatch = content.match(/^severity:\s*(.+)$/m);
             const todoArea = areaMatch ? areaMatch[1].trim() : 'general';
             // Apply area filter if specified
             if (area && todoArea !== area)
@@ -139,6 +183,7 @@ function cmdListTodos(cwd, area, raw) {
                 title: titleMatch ? titleMatch[1].trim() : 'Untitled',
                 area: todoArea,
                 path: toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(pendingDir, file))),
+                ...(severityMatch ? { severity: severityMatch[1].trim() } : {}),
             });
         }
     }
@@ -394,7 +439,8 @@ function cmdResolveGranularity(cwd, phaseType, raw, override) {
  *   { model, profile, effort, effort_rendered, effort_param, effort_propagation,
  *     fast_mode, fast_mode_supported, [unknown_agent] }
  *
- * Flags: --effort <level>, --fast-mode <true|false>, --attempt <n>
+ * Flags: --effort <level>, --fast-mode <true|false>, --attempt <n>,
+ *        --failure-class <class> (#2296)
  */
 function cmdResolveExecution(cwd, agentType, raw, opts) {
     if (!agentType) {
@@ -403,7 +449,29 @@ function cmdResolveExecution(cwd, agentType, raw, opts) {
     opts = opts || {};
     const config = loadConfig(cwd);
     const profile = config['model_profile'] || 'balanced';
-    const model = resolveModelInternal(cwd, agentType);
+    // #2068: resolve the model per-attempt so dynamic_routing escalates the MODEL
+    // (heavy tier) alongside effort. Gated on an explicit --attempt exactly like the
+    // effort resolution below, so the two fields stay symmetric: with no --attempt
+    // the model comes from the classic profile path (unchanged for everyone,
+    // including dynamic_routing-enabled users who don't pass --attempt), and only an
+    // explicit attempt routes through the tier ladder. resolveModelForTier itself
+    // still falls back to resolveModelInternal when dynamic_routing is off.
+    let model = (opts.attempt !== undefined && opts.attempt !== null)
+        ? resolveModelForTier(cwd, agentType, opts.attempt)
+        : resolveModelInternal(cwd, agentType);
+    // #2296: when the caller reports WHY the previous attempt failed, consult the
+    // provider-escalation ladder. Only a quota/rate-limit class warrants it — a
+    // heavier tier on the same throttled provider is still throttled, so this
+    // ladder swaps providers instead. Gated on an explicit --failure-class so the
+    // JSON contract is byte-identical for every existing caller.
+    let escalation;
+    if (opts.failureClass !== undefined) {
+        const applicable = opts.failureClass === AGENT_FAILURE_CLASSES.QUOTA_EXCEEDED;
+        const resolved = resolveProviderEscalation(cwd, agentType, opts.attempt, applicable);
+        if (resolved.escalated)
+            model = resolved.to;
+        escalation = { class: opts.failureClass, ...resolved };
+    }
     const effortOpts = {};
     if (typeof opts.effortOverride === 'string')
         effortOpts['override'] = opts.effortOverride;
@@ -430,6 +498,8 @@ function cmdResolveExecution(cwd, agentType, raw, opts) {
     };
     if (!agentModels)
         result['unknown_agent'] = true;
+    if (escalation)
+        result['escalation'] = escalation;
     output(result, raw, effort);
 }
 /**
@@ -1385,7 +1455,12 @@ function cmdStats(cwd, format, raw) {
                 name: existing?.name || phaseName,
                 plans: (existing?.plans || 0) + plans,
                 summaries: (existing?.summaries || 0) + summaries,
-                status,
+                // #2408: fold colliding statuses by precedence rather than overwriting
+                // last-write-wins. fs.readdirSync order is non-deterministic across
+                // platforms, so a naive overwrite can report a Complete phase as Not
+                // Started (or vice versa) depending on read order. The fold picks the
+                // furthest-along status, matching what an operator expects.
+                status: existing ? foldPhaseStatus(existing.status, status) : status,
             });
         }
     }
@@ -1507,6 +1582,8 @@ function cmdCheckCommit(cwd, raw) {
 module.exports = {
     groupFilesBySubrepo,
     determinePhaseStatus,
+    foldPhaseStatus,
+    PHASE_STATUS_PRECEDENCE,
     cmdGenerateSlug,
     cmdCurrentTimestamp,
     cmdListTodos,

package/gsd-core/bin/lib/config-loader.cjs

@@ -18,7 +18,7 @@
  *   - ./planning-workspace.cjs (planningDir, planningRoot)
  *   - ./shell-command-projection.cjs (execGit, platformWriteSync, platformReadSync)
  *   - ./core-utils.cjs       (detectSubRepos)
- *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS)
+ *   - ./model-catalog.cjs    (KNOWN_RUNTIMES, KNOWN_PROVIDERS, ADAPTIVE_TIER_VALUES)
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -172,7 +172,11 @@ function isGitIgnored(cwd, targetPath) {
     return ignored;
 }
 // ─── Model alias resolution ───────────────────────────────────────────────────
-const RUNTIME_OVERRIDE_TIERS = new Set(['opus', 'sonnet', 'haiku']);
+// Catalog-derived (model-catalog.cts) so this vocabulary can never drift from
+// VALID_TIERS in verify.cts — see #2070 "Generative Fix Divergence". Excludes
+// 'inherit' (unlike VALID_TIERS): runtime overrides always resolve to a
+// concrete tier, never the adaptive sentinel.
+const RUNTIME_OVERRIDE_TIERS = model_catalog_cjs_1.ADAPTIVE_TIER_VALUES;
 const _warnedConfigKeys = new Set();
 function _warnUnknownProfileOverrides(parsed, configLabel) {
     if (!parsed || typeof parsed !== 'object')
@@ -687,6 +691,14 @@ function loadConfigResolved(cwd, options = {}) {
                 fast_mode: (globalDefaults['fast_mode']) || null,
                 agent_skills: (globalDefaults['agent_skills']) || {},
                 response_language: (globalDefaults['response_language']) || null,
+                // #2069: forward model_policy / model_profile_overrides / runtime so the global-defaults
+                // path is at parity with the project-config path (which forwards these three from
+                // parsed['…'] at the top of this function). Without these entries, ~/.gsd/defaults.json
+                // silently drops them — model_policy/provider/budget etc. are honored when set in a
+                // project but ignored when set globally.
+                runtime: (globalDefaults['runtime']) || null,
+                model_profile_overrides: (globalDefaults['model_profile_overrides']) || null,
+                model_policy: (globalDefaults['model_policy']) || null,
             };
             // Branch D: global-defaults
             try {

package/gsd-core/bin/lib/config.cjs

@@ -67,6 +67,45 @@ const SCHEMA_DEFAULTS = {
     'executor.stall_threshold_minutes': 10,
     'git.create_tag': true,
 };
+/**
+ * Resolve a schema-level default for an absent key (#2256). Checks the legacy
+ * hardcoded SCHEMA_DEFAULTS first, then the capability-registry configSchema
+ * default — the same registry default the runtime's capability-activation
+ * resolver (resolveConfigKey Level 4, capability-activation.cts) already honors,
+ * so `query config-get` can no longer disagree with the runtime about an absent
+ * key's effective value.
+ */
+function resolveSchemaDefault(cwd, kp) {
+    if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
+        return { found: true, value: SCHEMA_DEFAULTS[kp] };
+    }
+    const capSchema = getCapabilityConfigSchema(cwd);
+    if (capSchema && typeof capSchema === 'object'
+        && Object.prototype.hasOwnProperty.call(capSchema, kp)) {
+        const entry = capSchema[kp];
+        if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+            const def = entry['default'];
+            if (def !== undefined)
+                return { found: true, value: def };
+        }
+    }
+    return { found: false, value: undefined };
+}
+/**
+ * Emit a schema-resolved default (#2256), applying the same secret-masking
+ * invariant the found-key path applies. getCapabilityConfigSchema is a
+ * federated, third-party-extensible surface (ADR-1244) — a future key-name
+ * collision with a secret key must not leak a declared default in plaintext.
+ * Centralizing emission here means masking can't be missed at a call site.
+ */
+function emitResolvedDefault(kp, value, raw) {
+    if ((0, secrets_cjs_1.isSecretKey)(kp)) {
+        const masked = (0, secrets_cjs_1.maskSecret)(value);
+        output(masked, raw, masked);
+        return;
+    }
+    output(value, raw, String(value));
+}
 // ─── Validation helpers ───────────────────────────────────────────────────────
 function validateKnownConfigKeyPath(keyPath) {
     const suggested = CONFIG_KEY_SUGGESTIONS[keyPath];
@@ -698,6 +737,10 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid statusline.show_context_tokens '${val}'. Must be a boolean (true or false).`);
         }
     }
+    // Statusline GSD-state format enum validation
+    const VALID_STATE_FORMATS = ['full', 'compact'];
+    if (kp === 'statusline.state_format')
+        assertEnumValue(parsedValue, val, VALID_STATE_FORMATS, 'statusline.state_format');
     // statusline.show_git — boolean only
     if (kp === 'statusline.show_git') {
         if (typeof parsedValue !== 'boolean') {
@@ -825,16 +868,15 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
             config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
         }
         else if (hasDefault) {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
-            output(defaultValue, raw, String(defaultValue));
-            return;
-        }
-        else if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
+            emitResolvedDefault(kp, defaultValue, raw);
             return;
         }
         else {
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
+                return;
+            }
             error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
         }
     }
@@ -848,29 +890,38 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
             if (hasDefault) {
-                output(defaultValue, raw, String(defaultValue));
+                emitResolvedDefault(kp, defaultValue, raw);
                 return;
             }
-            if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-                const def = SCHEMA_DEFAULTS[kp];
-                output(def, raw, String(def));
+            const sd = resolveSchemaDefault(cwd, kp);
+            if (sd.found) {
+                emitResolvedDefault(kp, sd.value, raw);
                 return;
             }
             error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
         }
-        current = current[key];
+        // Own-property gate: bracket access on a plain object walks the
+        // prototype chain, so an unqualified `current[key]` would resolve
+        // '__proto__' / 'constructor' / 'hasOwnProperty' (and other
+        // Object.prototype members) to their inherited values instead of
+        // correctly reporting them as absent. hasOwnProperty.call only
+        // returns true for a key JSON.parse actually assigned as data on
+        // this object (including a literal "__proto__" JSON key, which
+        // JSON.parse defines as an own data property, not the accessor) —
+        // never for something inherited from the prototype chain.
+        current = Object.prototype.hasOwnProperty.call(current, key)
+            ? current[key]
+            : undefined;
     }
     if (current === undefined) {
-        // eslint-disable-next-line @typescript-eslint/no-base-to-string
         if (hasDefault) {
-            output(defaultValue, raw, String(defaultValue));
+            emitResolvedDefault(kp, defaultValue, raw);
             return;
         }
-        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
+        const sd = resolveSchemaDefault(cwd, kp);
+        if (sd.found) {
+            emitResolvedDefault(kp, sd.value, raw);
             return;
         }
         error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);

package/gsd-core/bin/lib/core-utils.cjs

@@ -186,8 +186,13 @@ function extractCanonicalPlanId(filename) {
     // or a single-digit-plus-letter id ("3A"); a *bare* single digit is a slug word,
     // so "46-6-rs-…" is not paired into a "46-6" id while "3A-01" stays intact.
     const tokenRe = /^(?:\d{2,}[A-Z]?|\d[A-Z])(?:\.\d+)*$/i;
+    // #2232: the PAIRED plan component is a zero-padded continuation segment
+    // (exactly 2 digits), so a ≥3-digit slug word (a year) is not paired into a
+    // bogus "14-2026" id. The leading phase component keeps tokenRe's unbounded
+    // \d{2,} — phase numbers ≥100 are legitimate; only continuations are capped.
+    const planTokenRe = new RegExp(`^(?:${phaseIdModule.PHASE_CONTINUATION_SEGMENT_SOURCE}[A-Z]?|\\d[A-Z])(?:\\.\\d+)*$`, 'i');
     const phaseIdx = parts.findIndex(p => tokenRe.test(p));
-    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && tokenRe.test(parts[phaseIdx + 1])) {
+    if (phaseIdx >= 0 && phaseIdx + 1 < parts.length && planTokenRe.test(parts[phaseIdx + 1])) {
         return `${parts[phaseIdx]}-${parts[phaseIdx + 1]}`;
     }
     return base;

package/gsd-core/bin/lib/decisions.cjs

@@ -54,6 +54,26 @@ const bulletEmDashRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+
  * only colon permitted before `**`. (#1639)
  */
 const bulletTitledColonRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^:*]*:[^:*]*\*\*\s*(.*)$/;
+/**
+ * #2347: format-agnostic evidence that a block/section holds real decision
+ * ENTRIES the parser could not read — a bullet whose bold lead-in is an
+ * ID-SHAPED token (uppercase prefix, optional digits, hyphen, alnum), whatever
+ * the exact ID grammar. The three parser grammars above all require a `D-`
+ * prefix; #1365's fail-loud guard reused that same `\bD-` test as its "is this
+ * decision-shaped?" evidence, so any other prefix (e.g. `D5-01`) was invisible
+ * to BOTH parser and guard, collapsing `could-not-parse` into a clean
+ * `none-present` pass.
+ *
+ * The ID-shape requirement (not "any bold bullet") is deliberate: a decisions
+ * block or `### Claude's Discretion` sub-section legitimately contains prose
+ * bullets with bold labels (`- **Scope:** …`, `- **Why:** …`, `- **Note:** …`).
+ * Those are NOT decision entries and must stay `none-present` — a false
+ * `could-not-parse` hard-blocks the plan gate. `[A-Z]+[0-9]*-[A-Za-z0-9]` matches
+ * `D-01` / `D5-01` / `DEC-01` but not `Scope:` / `Why:` / `Follow-up:` (mixed
+ * case) / `TODO:` (no `-<alnum>` id) — mirroring the parser's own `D-<alnum>`
+ * shape without hardcoding the `D`.
+ */
+const boldLeadInBulletRe = /^\s*-\s+\*\*[A-Z]+[0-9]*-[A-Za-z0-9]/m;
 /**
  * Parse decision lines from a block of text (the inner text of a <decisions>
  * or markdown-header section body). Returns the extracted decisions and a count
@@ -193,11 +213,13 @@ function extractDecisions(content) {
         }
         // FIX A: Block present but 0 extracted and no parse-misses.
         // Only report could-not-parse when there is genuine evidence of real decisions
-        // that failed to parse: a \bD- token in the block text, or an unterminated fence.
-        // An empty scaffold (<decisions></decisions>) or an all-prose block has no such
-        // evidence — treat as none-present so the gate passes cleanly.
+        // that failed to parse: a bold-lead-in bullet (`- **…**`, any ID grammar — #2347),
+        // a \bD- token in the block text, or an unterminated fence. An empty scaffold
+        // (<decisions></decisions>) or an all-prose block has no such evidence — treat
+        // as none-present so the gate passes cleanly.
         const hasDecisionTokenInBlock = /\bD-[A-Za-z0-9]/m.test(combined);
-        if (hasDecisionTokenInBlock || unterminatedFence) {
+        const hasBoldLeadInBullet = boldLeadInBulletRe.test(combined);
+        if (hasDecisionTokenInBlock || hasBoldLeadInBullet || unterminatedFence) {
             return { decisions: [], outcome: 'could-not-parse' };
         }
         return { decisions: [], outcome: 'none-present' };
@@ -217,11 +239,13 @@ function extractDecisions(content) {
             return { decisions, outcome: 'could-not-parse' };
         }
         // FIX A: Heading found but 0 extracted and no parse-misses.
-        // Only report could-not-parse when the section body contains a D- token.
-        // A heading with only prose, sub-headings, or all-discretion content
-        // (no trackable D- tokens) is a legitimate empty/discretion section → none-present.
+        // Report could-not-parse when the section body holds a decision-entry-shaped
+        // bold-lead-in bullet (`- **…**`, any ID grammar — #2347) or a D- token. A
+        // heading with only prose, sub-headings, or all-discretion content (no such
+        // evidence) is a legitimate empty/discretion section → none-present.
         const hasDecisionTokenInSection = /\bD-[A-Za-z0-9]/m.test(section.body);
-        if (hasDecisionTokenInSection) {
+        const hasBoldLeadInBulletInSection = boldLeadInBulletRe.test(section.body);
+        if (hasDecisionTokenInSection || hasBoldLeadInBulletInSection) {
             return { decisions: [], outcome: 'could-not-parse' };
         }
         return { decisions: [], outcome: 'none-present' };

package/gsd-core/bin/lib/docs.cjs

@@ -259,6 +259,12 @@ function cmdDocsInit(cwd, raw) {
     const agentStatus = checkAgentsInstalled();
     result['agents_installed'] = agentStatus.agents_installed;
     result['missing_agents'] = agentStatus.missing_agents;
+    // #2402: withProjectRoot injects response_language when set; cmdDocsInit predates
+    // that helper and never picked it up, so docs-update's orchestrator-owned prompts
+    // silently stayed English even with response_language configured.
+    if (config.response_language) {
+        result['response_language'] = config.response_language;
+    }
     output(result, raw, undefined);
 }
 module.exports = { cmdDocsInit };

package/gsd-core/bin/lib/external-descriptor-trust.cjs

@@ -26,9 +26,21 @@ exports.isPathConfined = isPathConfined;
 exports.assertDescriptorConfined = assertDescriptorConfined;
 const node_path_1 = __importDefault(require("node:path"));
 /**
- * Pure path-containment check (cross-platform). `target` is confined to `root`
- * iff resolving it relative to `root` yields a path equal to or under `root`.
+ * Pure LEXICAL path-containment check (cross-platform). `target` is confined
+ * to `root` iff resolving it relative to `root` (via `path.resolve` — string
+ * manipulation, no filesystem access) yields a path equal to or under `root`.
  * Absolute paths outside `root` and `..`-escapes return false.
+ *
+ * NOT a realpath check: this function never calls `fs.realpathSync` and does
+ * not detect a symlink along `target` (or an existing path component of
+ * `root`) that would redirect the LEXICALLY-confined path to a physically
+ * different, unconfined location on disk. A caller relying on this for a
+ * write-confinement guarantee against a symlink-planting attacker must pair
+ * it with a symlink check (or refuse to follow symlinks at write time) — see
+ * capability-source.cts's install adapters (:491,577,675), which is what
+ * currently keeps every caller of this function's callers symlink-safe: they
+ * reject symlinks upstream, before a target ever reaches a lexical-only check
+ * like this one.
  */
 function isPathConfined(target, root) {
     if (typeof target !== 'string' || typeof root !== 'string' || target.length === 0 || root.length === 0) {

package/gsd-core/bin/lib/gap-checker.cjs

@@ -298,7 +298,16 @@ function runGapAnalysis(cwd, phaseDir, options = {}) {
         const mismatchMsg = '## Post-Planning Gap Analysis\n\nextracted 0 of N — possible format mismatch in CONTEXT.md decisions block.\n';
         // If there are also requirement items, include them in the return with the
         // mismatch summary appended, so the caller still sees requirement coverage.
-        if (items.length > 0) {
+        // #2334 HIGH 1: gate on `ghostReqIds.length > 0` too — identical defect to
+        // the one fixed at #2316-6b (~34 lines below, at the `items.length === 0`
+        // early return): a phase whose EVERY cited REQ-ID is unregistered has
+        // `items.length === 0` (all its requirement items were filtered out at
+        // ~line 297) but still has real ghost rows to report. Without this guard,
+        // a single malformed `<decisions>` line in CONTEXT.md made an all-ghost
+        // phase's ghost rows silently vanish (this could-not-parse branch fell
+        // through to the bare `mismatchMsg`-only return below, dropping ghost
+        // rows that the general path further down correctly surfaces).
+        if (items.length > 0 || ghostReqIds.length > 0) {
             const rows = sortRows([
                 ...detectCoverage(items, planText),
                 ...ghostReqIds.map(id => ({ source: 'REQUIREMENTS.md', item: id, status: 'Missing from REQUIREMENTS.md' })),
@@ -325,7 +334,13 @@ function runGapAnalysis(cwd, phaseDir, options = {}) {
         };
     }
     // #1365: if no items at all, surface a clean no-check message.
-    if (items.length === 0) {
+    // #2316-6b: this must NOT fire when `ghostReqIds` is non-empty — a phase
+    // whose EVERY cited REQ-ID is unregistered has `items.length === 0` (all
+    // its requirement items were filtered out at ~line 297) but still has real
+    // ghost rows to report below. Without this guard, an all-orphan phase
+    // reported LESS than a partially-orphan one (which falls through to the
+    // general path further down and correctly surfaces its ghost rows).
+    if (items.length === 0 && ghostReqIds.length === 0) {
         return {
             enabled: true,
             rows: [],