@pareto4/pp-core 1.12.1 → 1.17.1

package/pp-core/bin/lib/config.cjs

@@ -29,9 +29,14 @@ const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTab
 const configSchema = require("./config-schema.cjs");
 const { VALID_CONFIG_KEYS, isValidConfigKey, capabilityEnumValues } = configSchema;
 const secrets_cjs_1 = require("./secrets.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityActivation = require("./capability-activation.cjs");
+// GATE-05: reuse the activation resolver's flat-form lookup rather than growing
+// a second copy of the rule here. capability-activation.cjs depends only on
+// planning-workspace.cjs and node builtins, so this import adds no cycle.
+const { _getFlatConfigValue } = capabilityActivation;
 const review_reviewer_selection_cjs_1 = require("./review-reviewer-selection.cjs");
 const configuration_cjs_1 = require("./configuration.cjs");
-const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CONFIG_KEY_SUGGESTIONS = {
     'workflow.nyquist_validation_enabled': 'workflow.nyquist_validation',
@@ -465,6 +470,20 @@ function setConfigValues(cwd, entries) {
         }
     });
 }
+/**
+ * The complete `init.probe_status` vocabulary, as `pp-tools config-set`
+ * enforces it (07-11 / WR-04).
+ *
+ * The vocabulary's OWNER is `INIT_PROBE_STATUS` in `init-contract.cts`, which
+ * is where the record writers (`--record-probe` / `--defer-probe`) take it
+ * from. This is a deliberate copy, not a re-export: `config.cts` is a leaf and
+ * `init-contract.cjs` pulls in capability-activation, compose-bindings and
+ * org-profile, so importing it here would introduce a leaf-to-adapter edge.
+ * What keeps the copy honest is the two-direction parity test in
+ * `tests/config.test.cjs` — widening either vocabulary without the other
+ * reddens it.
+ */
+const VALID_INIT_PROBE_STATUSES = Object.freeze(['passed', 'failed', 'deferred']);
 /**
  * The ONE membership test every enum guard in `cmdConfigSet` asks (13-REVIEW
  * CR-01). The raw value is parsed before the guards — `true`/`false`/numbers
@@ -485,14 +504,21 @@ function isStringMember(list, value) {
  * (`"FALSE"`, `"no"`, `"off"`) or a number. `capability-activation`'s
  * `_resolveActivationValue` ends in `Boolean(r.value)`, so those strings read as
  * ON — an operator typing `config-set vault.enabled FALSE` to switch the vault
- * off instead ARMED every step `capabilities/vault` hangs on that key, against
- * the constraint that a `vault.enabled=false` project stays completely inert.
+ * off instead ARMED the two `blocking: true` / `onError: halt` gates
+ * `capabilities/vault` hangs on that key, against CLAUDE.md's constraint that a
+ * `vault.enabled=false` project stays completely inert.
  *
- * The list, not ten copies of the same `if`: the first seven are capability
- * activation keys read through that `Boolean()` (the vault switches plus every
- * key that gates a blocking hook in the shipped registry). The last three were already guarded individually and are folded in here
- * unchanged, message included, so there is one mechanism in this file rather
- * than two.
+ * The list, not eleven copies of the same `if`: the first eight are every key
+ * that gates a blocking hook through that `Boolean()` read, and
+ * `tests/config.test.cjs` DERIVES that requirement from the shipped capability
+ * registry, so a future blocking gate on a new key reddens until it joins.
+ * `vault.required` is the recorded 02-SECURITY UF-01 instance of the same
+ * defect: its READ path already refuses a non-boolean (`booleanPolicyValue` in
+ * `src/org-profile.cts`), but the CLI door still answered `{"updated": true}` for a
+ * value the reader would then discard — the exact "reports success, changes
+ * nothing" shape UF-01 was opened for. The last three were already guarded
+ * individually and are folded in here unchanged, message included, so there is
+ * one mechanism in this file rather than two.
  *
  * REFUSE, do not normalise: `FALSE` plainly means false, but `1`, `enabled` and
  * `on` are guesses, and a config-set that silently rewrites the operator's word
@@ -501,8 +527,8 @@ function isStringMember(list, value) {
  */
 const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
     'vault.enabled',
-    'vault.required',
     'vault.practices_enabled',
+    'vault.required',
     'workflow.schema_drift_gate',
     'workflow.nyquist_validation',
     'workflow.security_enforcement',
@@ -578,10 +604,6 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     if (kp === 'ship.pr_body_sections') {
         validateShipPrBodySections(parsedValue);
     }
-    // Phase ceremony tier (pack 9) — enum, src/phase-tier.cts owns the list
-    if (kp === 'phase.tier' && !isStringMember(phase_tier_cjs_1.PHASE_TIERS, parsedValue)) {
-        error(`Invalid phase.tier '${val}'. Valid values: ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
-    }
     // Human verification checkpoint mode (#3309)
     const VALID_HUMAN_VERIFY_MODES = ['mid-flight', 'end-of-phase'];
     if (kp === 'workflow.human_verify_mode' && !isStringMember(VALID_HUMAN_VERIFY_MODES, parsedValue)) {
@@ -601,14 +623,27 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     if (kp === 'code_quality.fallow.profile' && !isStringMember(VALID_FALLOW_PROFILES, parsedValue)) {
         error(`Invalid code_quality.fallow.profile '${val}'. Valid values: ${VALID_FALLOW_PROFILES.join(', ')}`);
     }
+    // init.probe_status enum validation (07-11 / WR-04). 07-02 registered the
+    // four `init.probe_*` keys so config-set would not reject them as unknown;
+    // two shipped descriptions then claimed an out-of-vocabulary value "is
+    // refused at write time", which was true only of the record writers. This
+    // guard makes the claim true on this path too. Membership is tested on the
+    // parsed value's TYPE as well (13-REVIEW CR-01): `true`/`false`/numbers are
+    // coerced above and a `[`/`{` value is JSON-parsed, so only a plain string
+    // can be a member. A VALID value set here is still accepted — that is T-07-09's disclosed
+    // accepted residual, not an oversight.
+    if (kp === 'init.probe_status' && !isStringMember(VALID_INIT_PROBE_STATUSES, parsedValue)) {
+        error(`Invalid init.probe_status '${val}'. Valid values: ${VALID_INIT_PROBE_STATUSES.join(', ')}`, ERROR_REASON.USAGE);
+    }
     // plan_review.source_grounding_authority (#22) — enum
     const VALID_SOURCE_GROUNDING_AUTHORITIES = ['grep', 'intel', 'treesitter', 'lsp', 'scip'];
     if (kp === 'plan_review.source_grounding_authority' && !isStringMember(VALID_SOURCE_GROUNDING_AUTHORITIES, parsedValue)) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
-    // Capability enum keys, in ONE place (13-05, D-07). Measured 2026-10-09:
-    // `config-set workflow.code_review_depth bogus` wrote at exit 0, as did every
-    // other enum key, because no guard consulted the registry's declared `values`. This runs AFTER every
+    // Capability enum keys, in ONE place (Vault Assurance 13-05, D-07). Measured
+    // 2026-10-09: `config-set workflow.code_review_depth bogus` and
+    // `config-set vault.mode whatever` both wrote at exit 0, because no guard
+    // consulted the registry's declared `values`. This runs AFTER every
     // hand-coded guard above, so a key that already has its own guard
     // (`workflow.drift_action`) keeps its message byte-identical; the
     // registry, through `capabilityEnumValues`, is the only list consulted
@@ -618,8 +653,9 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
     // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
     // so a membership-only test let a one-element array through and wrote it —
-    // which `federated-config` silently reads back as the default for an enum
-    // key. Every declared capability enum value is a string, so a non-string
+    // which `resolveVaultMode` then refused on every vault command, and which
+    // `federated-config` silently reads back as the default for the other enum
+    // keys. Every declared capability enum value is a string, so a non-string
     // parse (array, object, number, boolean) can never be a member.
     const enumValues = capabilityEnumValues(kp);
     if (enumValues && !isStringMember(enumValues, parsedValue)) {
@@ -651,8 +687,7 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         output(maskedResult, raw, `${kp}=${masked}`);
         return;
     }
-    // Pack 6 D-07: the WRITTEN value stays raw; its echo (and the value it
-    // replaced) is display-safe.
+    // VAULT-EGRESS-1: the written value stays raw; the echo of it (and of the value it replaced) is display-safe.
     const shownValue = redactConfigCoordinates(kp, parsedValue);
     const shownResult = {
         ...setConfigValueResult,
@@ -662,15 +697,16 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     output(shownResult, raw, `${kp}=${String(shownValue)}`);
 }
 /**
- * Pack 6 D-07: the display-safe form of a config value about to be EMITTED,
- * for the config keys that hold a remote repo coordinate (the shared-tier repo,
- * `SHARED_REPO_CONFIG_KEY`). `keyPath` is the dotted path the value was read
- * at (`''` for the whole config): the key itself, or any ancestor object that
- * carries it, is projected through the one owner (`redactCloneTarget` in
- * src/vault.cts); every other value is returned untouched (and a
- * credential-free coordinate is unchanged by the owner). The file on disk and
- * every in-process reader keep the raw value. Lazily required, so this
- * module's load graph is unchanged.
+ * VAULT-EGRESS-1 (quick 261005-8py gap closure): the display-safe form of a
+ * config value about to be EMITTED, for the one config key that is a remote
+ * repo coordinate (the shared-tier repo, `SHARED_REPO_CONFIG_KEY`). `keyPath`
+ * is the dotted path the value was read at (`''` for the whole config): the
+ * key itself, or any ancestor whose object carries it, is projected through
+ * the ONE owner (`redactCloneTarget`, `src/vault.cts`); every other value is
+ * returned untouched. The file on disk and every in-process reader keep the
+ * raw value — this runs at emission only, the same posture `isSecretKey`
+ * masking already takes on this surface. The key is read from its owner
+ * module rather than written here (this file names no allowlisted key).
  */
 function redactConfigCoordinates(keyPath, value) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -688,7 +724,7 @@ function redactConfigCoordinates(keyPath, value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         return value;
     const copy = JSON.parse(JSON.stringify(value));
-    // The flat form: the whole dotted key written as one top-level property.
+    // GATE-05's flat form: the whole dotted key written as one top-level property.
     if (at.length === 0 && typeof copy[SHARED_REPO_CONFIG_KEY] === 'string') {
         copy[SHARED_REPO_CONFIG_KEY] = safe(copy[SHARED_REPO_CONFIG_KEY]);
     }
@@ -712,23 +748,77 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     }
     // After the error() guard, keyPath is narrowed to string.
     const kp = keyPath;
-    let config = {};
-    try {
-        if (node_fs_1.default.existsSync(configPath)) {
-            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+    /**
+     * 02-04: the fall-back tail shared by every `config-get` miss.
+     *
+     * PRECEDENCE — project config > org profile > `--default` > SCHEMA_DEFAULTS >
+     * error. This helper is only ever reached AFTER both dotted forms of the
+     * project read have missed, so project config outranking the profile is
+     * structural here rather than a comparison someone has to keep correct. That
+     * ordering is T-02-17's mitigation and is load-bearing: a fleet-wide profile
+     * must never be able to overrule what the project itself configured.
+     *
+     * Wiring this closes the gap `resolveVaultRequired` documents — the vault
+     * policy key's workflow line reads it through `config-get`, so before this
+     * existed a profile-seeded value reached that resolver's callers but never
+     * that workflow. (The key is named in `org-profile.cts`, not here: this file
+     * stays free of any allowlisted key literal so the "resolution is generic"
+     * check stays a meaningful grep.)
+     *
+     * NO KEY IS NAMED HERE, deliberately. `readProfileValue` self-gates on
+     * ORG_PROFILE_ALLOWLIST and does zero filesystem access for a key that is not
+     * on it, so consulting it on every miss is free for the overwhelmingly common
+     * non-allowlisted key and the wiring stays generic — adding a key to that
+     * allowlist is sufficient to make it readable here.
+     *
+     * Warnings go to fd 2 only; stdout stays byte-clean so `--raw` still emits a
+     * bare scalar (UIBR-02).
+     */
+    const missFallback = (missMessage, missReason) => {
+        // Call-time lazy require, matching org-profile.cts's own use of the pattern
+        // for git-provider.cjs. org-profile.cjs does not import config.cjs, so this
+        // adds no cycle — keep it that way.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const orgProfile = require('./org-profile.cjs');
+        let profileValue;
+        try {
+            const profile = orgProfile.readProfileValue(cwd, kp);
+            profileValue = profile.value;
+            for (const w of profile.warnings)
+                console.error('Warning: ' + w);
+        }
+        catch {
+            // A malformed or unreadable profile must never take down a config read
+            // that would otherwise have resolved a default. Degrade to "no profile".
+            profileValue = undefined;
+        }
+        if (profileValue !== undefined) {
+            const shownProfileValue = redactConfigCoordinates(kp, profileValue);
+            output(shownProfileValue, raw, String(shownProfileValue));
+            return;
         }
-        else if (hasDefault) {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        if (hasDefault) {
             output(defaultValue, raw, String(defaultValue));
             return;
         }
-        else if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
+        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
             const def = SCHEMA_DEFAULTS[kp];
             output(def, raw, String(def));
             return;
         }
+        error(missMessage, missReason);
+    };
+    let config = {};
+    try {
+        if (node_fs_1.default.existsSync(configPath)) {
+            config = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        }
         else {
-            error('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            // No config.json at all: the profile still gets its turn before the
+            // defaults, or a config-less project could never see a profile value.
+            missFallback('No config.json found at ' + configPath, ERROR_REASON.CONFIG_NO_FILE);
+            return;
         }
     }
     catch (err) {
@@ -736,37 +826,35 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
             throw err;
         error('Failed to read config.json: ' + err.message, ERROR_REASON.CONFIG_PARSE_FAILED);
     }
+    // GATE-05: the same dotted key may be written flat — one top-level property
+    // whose name contains dots — which the nested walk below cannot see. Resolved
+    // here as a FALLBACK only: the walk runs first and, when it finds a value,
+    // this is never consulted. Nested therefore wins whenever both forms are
+    // present, matching capability-activation.cjs's getConfigValueEitherForm so
+    // the two read paths a gate uses answer identically. The rejected-segment and
+    // hasOwnProperty guards live in that shared helper.
+    const flatFallback = _getFlatConfigValue(config, kp);
     // Traverse dot-notation path (e.g., "workflow.auto_advance")
     const keys = kp.split('.');
     let current = config;
     for (const key of keys) {
         if (current === undefined || current === null || typeof current !== 'object') {
-            // eslint-disable-next-line @typescript-eslint/no-base-to-string
-            if (hasDefault) {
-                output(defaultValue, raw, String(defaultValue));
-                return;
-            }
-            if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-                const def = SCHEMA_DEFAULTS[kp];
-                output(def, raw, String(def));
-                return;
+            if (flatFallback.found) {
+                current = flatFallback.value;
+                break;
             }
-            error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            missFallback(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+            return;
         }
         current = current[key];
     }
+    // GATE-05: the walk completed but resolved nothing — flat form gets its turn.
+    if (current === undefined && flatFallback.found) {
+        current = flatFallback.value;
+    }
     if (current === undefined) {
-        // eslint-disable-next-line @typescript-eslint/no-base-to-string
-        if (hasDefault) {
-            output(defaultValue, raw, String(defaultValue));
-            return;
-        }
-        if (Object.prototype.hasOwnProperty.call(SCHEMA_DEFAULTS, kp)) {
-            const def = SCHEMA_DEFAULTS[kp];
-            output(def, raw, String(def));
-            return;
-        }
-        error(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+        missFallback(`Key not found: ${kp}`, ERROR_REASON.CONFIG_KEY_NOT_FOUND);
+        return;
     }
     // Never echo plaintext for sensitive keys via config-get. Plaintext lives
     // in config.json on disk; the CLI surface always shows the masked form.
@@ -775,7 +863,10 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         output(masked, raw, masked);
         return;
     }
-    // Pack 6 D-07: a remote coordinate (or a section carrying one) is emitted display-safe.
+    // Pre-existing behaviour, now explicit: an object-valued key under --raw
+    // stringifies to '[object Object]'. Replacing the trailing `error()` (typed
+    // `never`) with the shared miss-tail cost TypeScript the narrowing that used
+    // to keep this quiet; the emitted bytes are unchanged.
     const shown = redactConfigCoordinates(kp, current);
     output(shown, raw, String(shown));
 }
@@ -880,6 +971,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    VALID_INIT_PROBE_STATUSES,
     BOOLEAN_ONLY_CONFIG_KEYS,
     cmdConfigEnsureSection,
     cmdConfigSet,
@@ -890,7 +982,7 @@ module.exports = {
     cmdMigrateConfig,
     // Exported for programmatic use by capability-writer and tests
     setConfigValue,
-    // Pack 6 D-07: `state load` emits the whole config through the same projection.
-    redactConfigCoordinates,
     setConfigValues,
+    // VAULT-EGRESS-1: `state load` emits the whole config through the same projection.
+    redactConfigCoordinates,
 };

package/pp-core/bin/lib/decisions.cjs

@@ -10,6 +10,7 @@
  * CJS callers that only use {id, text} safely ignore the extra fields.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDecisionsReport = parseDecisionsReport;
 exports.parseDecisions = parseDecisions;
 const DISCRETION_HEADINGS = new Set([
     "claude's discretion",
@@ -17,6 +18,67 @@ const DISCRETION_HEADINGS = new Set([
     'claude discretion',
 ]);
 const NON_TRACKABLE_TAGS = new Set(['informational', 'folded', 'deferred']);
+// ── The decision-bullet grammar (260910-8ea) ────────────────────────────────
+//
+// Why a grammar rather than one regex: this repository writes THREE bullet
+// forms, and until 260910-8ea only the first was readable. The two others were
+// not exotic — they are what `discuss-phase` emits and what hand-authored
+// CONTEXT.md files use — so a parser that reads only form A hands a blocking
+// coverage gate an empty decision set and lets it report a clean pass. That is
+// the defect this grammar retires (todo: decision-coverage-gate-false-pass).
+//
+//   Form A  `- **D-NN:** text`                  → arm A
+//   Form B  `- **D-NN: Title.** text`           → arm B (title may wrap: arm D)
+//   Form C  `- **D-NN** text`                   → arm C
+//
+// HEAD matches the bullet opener and splits off `rest` (everything after the id
+// and its optional `[tags]` group). The id rule is #3575's, unchanged: the first
+// character after `D-` must be alphanumeric, so `D--x` and `D-_x` still fail
+// HEAD and reach the parse-miss guard.
+const BULLET_HEAD_RE = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?(.*)$/;
+// Arm A — form A, widened. The run before the FIRST `:**` may now contain `:`.
+// #1343 wrote that run as `[^:*]*`, which is what dropped every bold-title
+// bullet AND `- **D-07 ratio 3:1:** w` (that miss used to be pinned as a floor;
+// it now parses as D-07 / "w"). Lazy `[^*]*?` still stops at the first `:**`.
+const ARM_A_RE = /^([^*]*?):\*\*\s*(.*)$/;
+// Arm B — form B, the bold title. The title MAY contain `:` because real
+// titles carry backticked loop points (`plan:post`, `execute:post`, `check:`);
+// a title regex that excluded `:` measured four misses across two phases.
+const ARM_B_RE = /^([^*]*?):\s*([^*]*?)\s*\*\*\s*(.*)$/;
+// Arm C — the bold closes with no colon before it (`- **D-VH-1** body`, and
+// `- **D-13 → see D-14.** *(reserved)*`). The only thing this form lacks is
+// punctuation; the id is unambiguous, so it is admitted.
+const ARM_C_RE = /^([^*]*?)\s*\*\*\s*(.*)$/;
+// Arm D — no closing `**` on this line: a form-B title that wraps onto the
+// next line. The existing continuation logic appends the following indented
+// lines, stray `**` included (they are cosmetic in the resulting text).
+const ARM_D_RE = /^([^*]*)$/;
+/**
+ * Read a decision bullet's text out of `rest` (the remainder of the bullet line
+ * after the id and optional `[tags]`), trying arms A → B → C → D; first match
+ * wins. Returns null when no arm matches, which sends the line to the
+ * parse-miss guard.
+ *
+ * The guard is NOT vacuous after this widening: a malformed id fails HEAD, and
+ * a `rest` carrying a `*` in no arm shape (`- **D-01 *italic* no close`)
+ * matches no arm.
+ */
+function readBulletText(rest) {
+    const a = rest.match(ARM_A_RE);
+    if (a)
+        return a[2];
+    const b = rest.match(ARM_B_RE);
+    // Headline first, so a six-word `softPhrase` is drawn from the title.
+    if (b)
+        return (b[2] + ' ' + b[3]).trim();
+    const c = rest.match(ARM_C_RE);
+    if (c)
+        return (c[1] + ' ' + c[2]).trim();
+    const d = rest.match(ARM_D_RE);
+    if (d)
+        return d[1].replace(/^\s*:?\s*/, '').trim();
+    return null;
+}
 /**
  * Strip fenced code blocks from `content` so example `<decisions>` snippets
  * inside ```` ``` ```` do not pollute the parser (review F11).
@@ -40,34 +102,28 @@ function extractDecisionsBlock(content) {
     return matches.map((m) => m[1]).join('\n\n');
 }
 /**
- * Parse trackable decisions from CONTEXT.md content.
+ * Parse CONTEXT.md content into BOTH channels: the decisions that were read,
+ * and the bullets that could not be.
  *
- * Returns ALL D-NN decisions found inside `<decisions>` (including
- * non-trackable ones, with `trackable: false`). Callers that only want the
- * gate-enforced decisions should filter `.filter(d => d.trackable)`.
+ * `decisions` holds ALL D-NN decisions found inside `<decisions>` (including
+ * non-trackable ones, with `trackable: false`). `unparsed` holds every line
+ * that opened like a decision bullet and matched no arm of the grammar.
+ *
+ * The second channel exists because "the block was empty" and "the parser
+ * could not read any of it" are opposite situations that a coverage gate used
+ * to report identically — as a clean pass on a total of zero (260910-8ea).
  */
-function parseDecisions(content) {
+function parseDecisionsReport(content) {
     if (!content || typeof content !== 'string')
-        return [];
+        return { decisions: [], unparsed: [] };
     const block = extractDecisionsBlock(content);
     if (block === null)
-        return [];
+        return { decisions: [], unparsed: [] };
     const lines = block.split(/\r?\n/);
     const out = [];
+    const unparsed = [];
     let category = '';
     let inDiscretion = false;
-    // Bullet line: `- **D-NN[ [tags]]:** text`
-    // Phase 6 (#3575): aligned to CJS regex — accepts alphanumeric IDs (D-01, D-INFRA-01, D-FOO_BAR)
-    // in addition to numeric-only IDs (D-42). The first character after `D-` must
-    // be alphanumeric, so malformed shapes like `D--foo` or `D-_bar` are rejected.
-    // CJS callers consume {id, text} and ignore the optional extras.
-    // #1343: `[^:*]*` replaces the old `\s*` before `:**` so that a freeform run
-    // such as `(parenthetical)`, an em-dash, or other prose between the optional
-    // bracket-tag group and the closing `:**` is tolerated rather than silently
-    // dropping the whole decision. `[^:*]*` subsumes plain whitespace and stops
-    // correctly at `:**`. Capture groups 1 (id), 2 (bracket tags), 3 (text) are
-    // unchanged.
-    const bulletRe = /^\s*-\s+\*\*D-([A-Za-z0-9][A-Za-z0-9_-]*)(?:\s*\[([^\]]+)\])?[^:*]*:\*\*\s*(.*)$/;
     let current = null;
     const flush = () => {
         if (current) {
@@ -94,29 +150,36 @@ function parseDecisions(content) {
             inDiscretion = DISCRETION_HEADINGS.has(normalized);
             continue;
         }
-        const bulletMatch = line.match(bulletRe);
-        if (bulletMatch) {
+        const headMatch = line.match(BULLET_HEAD_RE);
+        const bulletText = headMatch ? readBulletText(headMatch[3]) : null;
+        if (headMatch && bulletText !== null) {
             flush();
-            const id = `D-${bulletMatch[1]}`;
-            const tags = bulletMatch[2]
-                ? bulletMatch[2]
+            const id = `D-${headMatch[1]}`;
+            const tags = headMatch[2]
+                ? headMatch[2]
                     .split(',')
                     .map((t) => t.trim().toLowerCase())
                     .filter(Boolean)
                 : [];
             const trackable = !inDiscretion && !tags.some((t) => NON_TRACKABLE_TAGS.has(t));
-            current = { id, text: bulletMatch[3], category, tags, trackable };
+            current = { id, text: bulletText, category, tags, trackable };
             continue;
         }
         // Parse-miss guard (#1343): a line that looks like a `D-NN` decision bullet
-        // but failed `bulletRe` (e.g. a `:` or `*` inside the pre-colon run) must NOT
+        // but failed HEAD (malformed id) or matched no arm of the grammar must NOT
         // be silently dropped — a narrowed trackable set lets a blocking coverage gate
         // report a false pass. Surface it loudly instead.
+        //
+        // 260910-8ea: the miss is now recorded as DATA as well, so a gate can fail
+        // on it rather than warning past it. The `console.warn` stays: the stderr
+        // signal is what a human running the command by hand sees, and it is pinned
+        // by the #1343 regression tests.
         if (/^\s*-\s+\*\*D-/.test(line)) {
             // A malformed D-bullet still starts a (failed) new decision, so it ends the
             // previous one — flush before warning so a following continuation line cannot
             // be mis-appended to the prior valid decision.
             flush();
+            unparsed.push({ line: trimmed, category });
             console.warn(`parseDecisions: ignored unparseable decision bullet: ${trimmed}`);
             continue;
         }
@@ -132,5 +195,19 @@ function parseDecisions(content) {
         }
     }
     flush();
-    return out;
+    return { decisions: out, unparsed };
+}
+/**
+ * Parse trackable decisions from CONTEXT.md content.
+ *
+ * Returns ALL D-NN decisions found inside `<decisions>` (including
+ * non-trackable ones, with `trackable: false`). Callers that only want the
+ * gate-enforced decisions should filter `.filter(d => d.trackable)`.
+ *
+ * This signature is unchanged, and so is its behaviour. A caller that must not
+ * treat an unreadable bullet as an ABSENT decision — any gate that reports a
+ * verdict — should call `parseDecisionsReport` and read `unparsed`.
+ */
+function parseDecisions(content) {
+    return parseDecisionsReport(content).decisions;
 }