fix: decimal coordinates are not phone numbers

[lewispeel]

What

pii.phone.e164 flags a run of decimal coordinates whenever the fractional parts happen to be 3-4 digits long. 37.6188 101.694 parses as 37 · 6188 · 101 · 694 and 100 64.5326 100 as 100 · 64 · 5326 · 100. That is the shape of SVG path data, mesh vertices and lat/long pairs, so a repo that commits one hand-drawn icon gets five MEDIUM findings on every push that touches it, and a /spec that quotes the path cannot pass the pre-issue gate (auto-redact would asterisk the coordinates). Same collision class as the parcel-ID exemption already in the validator.

Fix

looksLikeDecimalCoordinates(span) in lib/redact-patterns.ts, wired into the pii.phone.e164 validator beside looksLikeParcelId. Exempt on shape: space-separated tokens, at least one a decimal number (digits, one dot, digits), none with two dots.

Phone conventions put the dot between groups, so a dotted phone has two dots in one token (415.555.0123, +1 415.555.0123) and a spaced phone has none (+1 415 555 0123). Neither has a decimal token; both stay flagged.

The one form this concedes is a lone dotted pair beside a spaced group (415 555.0123), which no convention writes. It is pinned in the test as an explicit concession rather than left implicit.

Tests

test/redact-decimal-coordinates-false-positive.test.ts, mirroring redact-parcel-id-false-positive.test.ts: nine real phone shapes (dashed, parens, dotted, dotted with country code, E.164 US/UK/DE, bare 11-digit) stay flagged; an SVG segment, a full Figma-exported path in a TS string, mesh vertex triples, a lat/long pair and the integer-beside-decimal corner case go clean; the guard's narrowness is tested directly.

Ran redact-engine, redact-pattern-lint, redact-engine-autoredact, gstack-redact-cli, redact-parcel-id-false-positive and the new file: 207 pass, 0 fail. Rescanned the 6KB icons module that triggered this: 5 findings → 0.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here