@duckmind/dm-darwin-x64 0.66.5 → 0.66.6

package/extensions/dm-lens/clients/runtime-session.js

@@ -20,6 +20,7 @@ import { resetPendingRunnerFindings } from "./dispatch/pending-runner-findings.j
 import { clearAllSessions as clearFileTimeSessions } from "./file-time.js";
 import {
   drainProjectDataDirMigrations,
+  sweepDeadEphemeralDataDirs,
   getGlobalDmLensDir,
   getKnipIgnorePatterns,
   getProjectDataDir,
@@ -30,7 +31,7 @@ import { resetGoAvailability } from "./go-client.js";
 import {
   GovulncheckClient
 } from "./govulncheck-client.js";
-import { sweepAtomicWriteStages } from "./instance-reaper.js";
+import { realIsPidAlive, sweepAtomicWriteStages } from "./instance-reaper.js";
 import { canRunStartupHeavyScans } from "./language-policy.js";
 import {
   detectProjectLanguageProfile,
@@ -88,7 +89,6 @@ import {
 import { resetSituationalToolTelemetry } from "./situational-tool-telemetry.js";
 import {
   findNearestProjectRoot,
-  getStartupScanMaxEntries,
   isStartupScanVerdictFresh,
   resolveStartupScanContext
 } from "./startup-scan.js";
@@ -113,6 +113,30 @@ import { resetZizmorTokenAvailability } from "./zizmor-config.js";
 import { resetSpawnTimeoutCooldowns } from "./spawn-timeout-cooldown.js";
 import { resetTestRunnerDelivery } from "./test-runner-delivery.js";
 import { resetLspMutationNoBridgeDbgLatch } from "./lsp-mutation.js";
+function notifyStartupWarmSkip(args) {
+  if (!args.runtime.isCurrentSession(args.sessionGeneration))
+    return;
+  const reason = args.scan.reason;
+  if (reason !== "too-many-source-files" && reason !== "too-many-entries") {
+    return;
+  }
+  const bound = reason === "too-many-entries" ? {
+    name: "maxScanEntries",
+    value: args.scan.maxScanEntries,
+    hint: `set DM_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${args.scan.maxScanEntries}-entry cap`
+  } : {
+    name: "maxProjectFiles",
+    value: args.scan.maxProjectFiles,
+    hint: `set maxProjectFiles in .dm-lens.json to override the ${args.scan.maxProjectFiles}-source-file cap`
+  };
+  recordDegradationOnce({
+    kind: "startup-warm-skipped",
+    subject: args.analysisRoot,
+    reason: `${reason}; ${bound.name}=${bound.value}`,
+    metadata: { reason, [bound.name]: bound.value }
+  });
+  args.notify(`\uD83D\uDCE6 Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm) (${bound.hint}).`, "warning");
+}
 async function demandBootstrapDeps(deps, reason) {
   const clients = await deps.bootstrap.request(reason);
   if (!clients)
@@ -155,7 +179,8 @@ function snapshotSequenceBase(root) {
   return {
     projectSeq: index.projectSeq,
     fileSeqByPath: index.fileSeqByPath,
-    sinceSeq: meta.seq
+    sinceSeq: meta.seq,
+    logEntries: meta.logEntries ?? 0
   };
 }
 function recordSnapshotSequenceTimeout(args) {
@@ -174,7 +199,7 @@ function retroactivelyHydrateAfterDeferredSequence(args) {
   return (latestSeq) => {
     const published = args.getWarmupOwnSnapshotRead();
     const snapshot = published !== undefined ? published : loadProjectSnapshotExportsAndRules(args.snapshotRoot);
-    if (!snapshot || snapshot.version !== PROJECT_SNAPSHOT_VERSION || snapshot.seq !== latestSeq.projectSeq) {
+    if (!snapshot || snapshot.version !== PROJECT_SNAPSHOT_VERSION || snapshot.incomplete || (snapshot.logEntries ?? 0) < (latestSeq.unlockedThrough ?? 0) || snapshot.seq !== latestSeq.projectSeq) {
       return;
     }
     const hydrated = hydrateRuntimeFromProjectSnapshotIfIdle(args.runtime, snapshot);
@@ -187,7 +212,7 @@ function retroactivelyHydrateAfterDeferredSequence(args) {
 }
 function loadSnapshotBodyUnlessStale(args) {
   const meta = readProjectSnapshotMeta(args.root);
-  if (meta && isProjectSnapshotMetaStale(meta, args.currentProjectSeq)) {
+  if (meta && isProjectSnapshotMetaStale(meta, args.currentProjectSeq, args.unlockedThrough)) {
     args.dbg(`project_snapshot: meta gate stale (metaSeq=${meta.seq} metaVersion=${meta.version} current=${args.currentProjectSeq}) — skipping body parse`);
     return { snapshot: null, skippedStale: true };
   }
@@ -204,11 +229,14 @@ function describeSnapshotMiss(snapshot, currentProjectSeq, args) {
   if (snapshot.seq !== currentProjectSeq) {
     return `stale(seq=${snapshot.seq}, current=${currentProjectSeq})`;
   }
+  if ((snapshot.logEntries ?? 0) < args.unlockedThrough) {
+    return `unlocked-entry-after-fold(folded=${snapshot.logEntries ?? 0}, unlocked=${args.unlockedThrough})`;
+  }
   return "incompatible";
 }
 function logProjectSnapshotProbe(args) {
   args.dbg(`project_snapshot: probe root=${args.root} path=${getProjectSnapshotPath(args.root)} currentSeq=${args.currentProjectSeq}`);
-  if (isProjectSnapshotFresh(args.snapshot, args.currentProjectSeq)) {
+  if (isProjectSnapshotFresh(args.snapshot, args.currentProjectSeq, args.unlockedThrough)) {
     args.dbg(`project_snapshot: loaded seq=${args.snapshot.seq} exports=${args.snapshot.cachedExports.length} files=${Object.keys(args.snapshot.files ?? {}).length} reverseDeps=${Object.keys(args.snapshot.reverseDeps ?? {}).length} startupScan=${Boolean(args.snapshot.startupScan)} languageProfile=${Boolean(args.snapshot.languageProfile)}`);
   } else {
     args.dbg(`project_snapshot: miss reason=${args.missReason}`);
@@ -263,11 +291,25 @@ async function readSequenceWithBudget(args) {
       if (!runtime.isCurrentSession(sessionGeneration))
         return;
       if (runtime.projectSeq > 0) {
-        dbg("session_start: deferred sequence read completed, but the session already advanced (in-window edit) — skipping reseed to avoid clobbering it");
+        const mergeStartedAt = Date.now();
+        runtime.mergeProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath, latestSeq.logEntries);
+        logLatency({
+          type: "phase",
+          phase: "session_start_sequence_read_deferred_reseed",
+          filePath: cwd,
+          startedAt: new Date(mergeStartedAt).toISOString(),
+          durationMs: Date.now() - mergeStartedAt,
+          metadata: {
+            entries: latestSeq.fileSeqByPath.size,
+            deferred: true,
+            merged: true
+          }
+        });
+        dbg(`session_start: deferred sequence read completed after an in-window edit — merged projectSeq=${latestSeq.projectSeq} into the advanced session (now ${runtime.projectSeq})`);
         return;
       }
       const reseedStartedAt = Date.now();
-      runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath);
+      runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath, latestSeq.logEntries);
       logLatency({
         type: "phase",
         phase: "session_start_sequence_read_deferred_reseed",
@@ -503,7 +545,7 @@ async function buildOrRefreshWordIndex(args) {
         } else {
           runtime.wordIndex = index;
           let snapshotSaveSyncMs = 0;
-          if (!isProjectSnapshotFresh(snapshot, effectiveSeq) || result.refreshed > 0 || result.dropped > 0 || snapshot.wordIndex.truncated !== index.truncated) {
+          if (!isProjectSnapshotFresh(snapshot, effectiveSeq, latestSeq.unlockedThrough) || result.refreshed > 0 || result.dropped > 0 || snapshot.wordIndex.truncated !== index.truncated) {
             const serializeSaveEnqueueStartMs = Date.now();
             saveRuntimeProjectSnapshot({ cwd: snapshotRoot, runtime, dbg });
             snapshotSaveSyncMs = Date.now() - serializeSaveEnqueueStartMs;
@@ -1055,15 +1097,80 @@ function scheduleDeferredToolProbesWithClients(deps, languageProfile, startupDef
     dbg(`session_start tools (deferred probes complete, ${Date.now() - warmStart}ms): ${summary}`);
   })();
 }
-export const SESSION_START_GUIDANCE = [
-  `\uD83D\uDCCC dm-lens active — automated checks run on every edit/write; blocking errors (including pre-existing) show inline and must be fixed.
-` + `Key tools (see each tool's own description for args):
-` + `• lens_diagnostics — source=session reads cache; empty cache ≠ clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).
-` + `• symbol_search → module_report → read_symbol/read_enclosing — ranked identifier search, then navigable outline/callback handles + exact body reads; cheaper than reading a whole file before editing.
-` + "• Situational (activate via dm_lens_activate_tools): lsp_navigation, ast_grep_search, ast_grep_replace. Use ast_grep_search with dump=true to inspect AST nodes."
-];
+function readSubstituteGuidance(isEnabled) {
+  const units = [];
+  if (isEnabled("symbol_search")) {
+    units.push({ name: "symbol_search", role: "ranked identifier search" });
+  }
+  if (isEnabled("module_report")) {
+    units.push({
+      name: "module_report",
+      role: "navigable outline/callback handles"
+    });
+  }
+  const readSymbol = isEnabled("read_symbol");
+  const readEnclosing = isEnabled("read_enclosing");
+  if (readSymbol && readEnclosing) {
+    units.push({
+      name: "read_symbol/read_enclosing",
+      role: "exact body reads"
+    });
+  } else if (readSymbol) {
+    units.push({ name: "read_symbol", role: "exact body reads" });
+  } else if (readEnclosing) {
+    units.push({ name: "read_enclosing", role: "exact body reads" });
+  }
+  if (units.length === 0)
+    return;
+  const roles = units.map((unit) => unit.role);
+  const roleTail = roles.length === 1 ? roles[0] : roles.length === 2 ? `${roles[0]}, then ${roles[1]}` : `${roles[0]}, then ${roles[1]} + ${roles[2]}`;
+  return `• ${units.map((unit) => unit.name).join(" → ")} — ${roleTail}; cheaper than reading a whole file before editing.`;
+}
+function situationalGuidance(isEnabled) {
+  const active = [];
+  for (const name of [
+    "lsp_navigation",
+    "ast_grep_search",
+    "ast_grep_replace"
+  ]) {
+    if (isEnabled(name))
+      active.push(name);
+  }
+  if (active.length === 0)
+    return;
+  let text = `• Situational (activate via dm_lens_activate_tools): ${active.join(", ")}.`;
+  if (isEnabled("ast_grep_search")) {
+    text += " Use ast_grep_search with dump=true to inspect AST nodes.";
+  }
+  return text;
+}
+export function renderSessionStartGuidance(options = {}) {
+  const disabled = new Set(options.disabledToolNames ?? []);
+  const isEnabled = (name) => !disabled.has(name);
+  const requirePreExistingFixes = options.requirePreExistingFixes !== false;
+  const header = "\uD83D\uDCCC dm-lens active — automated checks run on every edit/write; " + (requirePreExistingFixes ? "blocking errors (including pre-existing) show inline and must be fixed." : "blocking errors you introduce must be fixed; pre-existing ones are only reported.");
+  const bullets = [];
+  if (isEnabled("lens_diagnostics")) {
+    bullets.push("• lens_diagnostics — source=session reads cache; empty cache ≠ clean; use source=lsp scope=paths for changed files with absent or stale findings (aggregate hosts: lens(action=diagnostics)).");
+  }
+  const readSubstitute = readSubstituteGuidance(isEnabled);
+  if (readSubstitute)
+    bullets.push(readSubstitute);
+  const situational = situationalGuidance(isEnabled);
+  if (situational)
+    bullets.push(situational);
+  const lines = [header];
+  if (bullets.length > 0) {
+    lines.push("Key tools (see each tool's own description for args):");
+    lines.push(...bullets);
+  }
+  return [lines.join(`
+`)];
+}
+export const SESSION_START_GUIDANCE = renderSessionStartGuidance();
 export async function handleSessionStart(deps) {
   resetDegradationLedger();
+  let sessionGenerationAtStart = deps.runtime.sessionGeneration;
   resetAnalyzerBootstrapSessionState();
   resetProjectDataDirSessionState();
   resetTestRunnerDelivery();
@@ -1144,6 +1251,13 @@ export async function handleSessionStart(deps) {
           });
           if (!scan.canWarmCaches) {
             warmupDbg(`warmup: skipping language-profile (canWarm=false, reason=${scan.reason ?? "unknown"})`);
+            notifyStartupWarmSkip({
+              scan,
+              analysisRoot: scan.projectRoot ?? warmupCwd,
+              notify: deps.notify,
+              runtime: deps.runtime,
+              sessionGeneration: sessionGenerationAtStart
+            });
             return;
           }
           const languageRoot = scan.projectRoot ?? warmupCwd;
@@ -1271,6 +1385,7 @@ export async function handleSessionStart(deps) {
   deps.bootstrap.peek()?.knipClient.resetSessionState?.();
   resetCascadeTierSessionState();
   runtime.resetForSession(sessionStartMs);
+  sessionGenerationAtStart = runtime.sessionGeneration;
   logLatency({
     type: "phase",
     phase: "session_start_runtime_reset",
@@ -1315,6 +1430,14 @@ export async function handleSessionStart(deps) {
   for (const migration of drainProjectDataDirMigrations()) {
     const targetName = path.basename(migration.to);
     const hash = targetName.match(/([0-9a-f]{8})$/)?.[1] ?? "unknown";
+    if (migration.outcome === "ephemeral") {
+      recordDegradationOnce({
+        kind: "data-dir-ephemeral",
+        subject: hash,
+        reason: "temporary checkout: project data lives in a process-owned directory and is not kept after exit"
+      });
+      continue;
+    }
     recordDegradationOnce({
       kind: "data_dir_migrated",
       subject: hash,
@@ -1330,6 +1453,7 @@ export async function handleSessionStart(deps) {
     path.join(globalDir, "bin"),
     path.join(globalDir, "tools")
   ]).catch(() => {});
+  sweepDeadEphemeralDataDirs({ isPidAlive: realIsPidAlive }).catch(() => {});
   if (quickMode) {
     runtime.projectRoot = cwd;
     const sequenceReadStartedAt = Date.now();
@@ -1362,7 +1486,7 @@ export async function handleSessionStart(deps) {
         snapshotPath: getProjectSnapshotPath(snapshotRoot)
       });
     }
-    runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath);
+    runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath, latestSeq.logEntries);
     const effectiveSeq = runtime.projectSeq ?? latestSeq.projectSeq;
     dbg(`session_start sequence: projectSeq=${effectiveSeq} fileSeqEntries=${latestSeq.fileSeqByPath.size}`);
     const freshnessSeq = timedOut ? UNKNOWN_PROJECT_SEQ : effectiveSeq;
@@ -1376,13 +1500,15 @@ export async function handleSessionStart(deps) {
     const snapshotGate = loadSnapshotBodyUnlessStale({
       root: snapshotRoot,
       currentProjectSeq: freshnessSeq,
+      unlockedThrough: latestSeq.unlockedThrough ?? 0,
       dbg
     });
     const snapshot = snapshotGate.snapshot;
-    const snapshotFresh = isProjectSnapshotFresh(snapshot, freshnessSeq);
+    const snapshotFresh = isProjectSnapshotFresh(snapshot, freshnessSeq, latestSeq.unlockedThrough);
     const snapshotMissReason = describeSnapshotMiss(snapshot, freshnessSeq, {
       skippedStale: snapshotGate.skippedStale,
-      bodyPresent: snapshotBodyPresent
+      bodyPresent: snapshotBodyPresent,
+      unlockedThrough: latestSeq.unlockedThrough ?? 0
     });
     logLatency({
       type: "phase",
@@ -1403,6 +1529,7 @@ export async function handleSessionStart(deps) {
       dbg,
       root: snapshotRoot,
       currentProjectSeq: freshnessSeq,
+      unlockedThrough: latestSeq.unlockedThrough ?? 0,
       snapshot,
       missReason: snapshotMissReason
     });
@@ -1444,8 +1571,7 @@ export async function handleSessionStart(deps) {
       metadata: {
         mode: startupMode,
         reason: deps.sessionReason,
-        classification: deps.sessionStartClassification,
-        sameRoot: deps.sessionStartSameRoot ?? "unknown"
+        ...sessionStartDecisionMetadata(deps)
       }
     });
     logHostReadyDelay(deps, cwd);
@@ -1487,7 +1613,7 @@ export async function handleSessionStart(deps) {
       snapshotPath: getProjectSnapshotPath(snapshotRoot)
     });
   }
-  runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath);
+  runtime.seedProjectSequence?.(latestSeq.projectSeq, latestSeq.fileSeqByPath, latestSeq.logEntries);
   const effectiveSeq = runtime.projectSeq ?? latestSeq.projectSeq;
   dbg(`session_start sequence: projectSeq=${effectiveSeq} fileSeqEntries=${latestSeq.fileSeqByPath.size}`);
   const freshnessSeq = timedOut ? UNKNOWN_PROJECT_SEQ : effectiveSeq;
@@ -1501,13 +1627,15 @@ export async function handleSessionStart(deps) {
   const snapshotGate = loadSnapshotBodyUnlessStale({
     root: snapshotRoot,
     currentProjectSeq: freshnessSeq,
+    unlockedThrough: latestSeq.unlockedThrough ?? 0,
     dbg
   });
   const snapshot = snapshotGate.snapshot;
-  const snapshotFresh = isProjectSnapshotFresh(snapshot, freshnessSeq);
+  const snapshotFresh = isProjectSnapshotFresh(snapshot, freshnessSeq, latestSeq.unlockedThrough);
   const snapshotMissReason = describeSnapshotMiss(snapshot, freshnessSeq, {
     skippedStale: snapshotGate.skippedStale,
-    bodyPresent: snapshotBodyPresent
+    bodyPresent: snapshotBodyPresent,
+    unlockedThrough: latestSeq.unlockedThrough ?? 0
   });
   logLatency({
     type: "phase",
@@ -1528,6 +1656,7 @@ export async function handleSessionStart(deps) {
     dbg,
     root: snapshotRoot,
     currentProjectSeq: freshnessSeq,
+    unlockedThrough: latestSeq.unlockedThrough ?? 0,
     snapshot,
     missReason: snapshotMissReason
   });
@@ -1644,7 +1773,10 @@ export async function handleSessionStart(deps) {
     tools.push("Rust (cargo)");
   log(`Active tools: ${tools.join(", ")}`);
   dbg(`session_start tools: ${tools.join(", ")}`);
-  const agentStartupGuidance = SESSION_START_GUIDANCE;
+  const agentStartupGuidance = renderSessionStartGuidance({
+    disabledToolNames: deps.disabledToolNames,
+    requirePreExistingFixes: deps.globalConfig?.contextInjection?.requirePreExistingFixes
+  });
   runtime.projectRulesScan = scanProjectRules(analysisRoot);
   saveRuntimeProjectSnapshot({
     cwd: snapshotRoot,
@@ -1677,10 +1809,13 @@ export async function handleSessionStart(deps) {
   } else if (!startupScan.canWarmCaches) {
     dbg(`session_start: skipping heavy scans (${startupScan.reason ?? "unknown"})`);
     dbg(`session_start: skipping TODO scan (${startupScan.reason ?? "unknown"})`);
-    if (startupScan.reason === "too-many-source-files" || startupScan.reason === "too-many-entries") {
-      const overrideHint = startupScan.reason === "too-many-entries" ? ` (set DM_LENS_STARTUP_SCAN_MAX_ENTRIES=<n> to override the ${getStartupScanMaxEntries()}-entry cap)` : "";
-      notify(`\uD83D\uDCE6 Project-size limits disabled background warm scans (heavy scans, TODO scan, LSP pre-warm)${overrideHint}.`, "warning");
-    }
+    notifyStartupWarmSkip({
+      scan: startupScan,
+      analysisRoot,
+      notify,
+      runtime,
+      sessionGeneration
+    });
   } else {
     scheduleStartupScans(deps, runtime, sessionGeneration, analysisRoot, snapshotRoot, languageProfile, dbg);
   }
@@ -1714,13 +1849,21 @@ export async function handleSessionStart(deps) {
     metadata: {
       mode: startupMode,
       reason: deps.sessionReason,
-      classification: deps.sessionStartClassification,
-      sameRoot: deps.sessionStartSameRoot ?? "unknown"
+      ...sessionStartDecisionMetadata(deps)
     }
   });
   logHostReadyDelay(deps, cwd);
   emitSmellsSessionStartLine(dbg, sessionStartMs);
 }
+function sessionStartDecisionMetadata(deps) {
+  return {
+    classification: deps.sessionStartClassification,
+    sameRoot: deps.sessionStartSameRoot ?? "unknown",
+    basis: deps.sessionStartBasis,
+    gapMs: deps.sessionStartGapMs,
+    lineageMatch: deps.sessionStartLineageMatch
+  };
+}
 function emitSmellsSessionStartLine(dbg, sessionStartMs) {
   try {
     const line = formatSmellsSessionStartLine(countRecentSmells(undefined, sessionStartMs));

package/extensions/dm-lens/clients/runtime-tool-call.js

@@ -8,14 +8,20 @@ import { evaluateGitGuard, isGitCommitOrPushAttempt } from "./git-guard.js";
 import { dropHashlineAnchorMemo } from "./hashline-anchor.js";
 import { evaluateSharedCheckoutGuard } from "./shared-checkout-guard.js";
 import { logLatency } from "./latency-logger.js";
-import { normalizeMapKey, toPosix } from "./path-utils.js";
+import { toPosix } from "./path-utils.js";
 import {
   captureFileStats,
   getOpaqueBaselineStore,
-  isGitWorktree
+  isGitWorktree,
+  opaqueBaselineSlot
 } from "./opaque-mutation-scan.js";
 import { normalizeForGuardMatch } from "./host-edit-normalize.js";
 import { retargetReplacementIndentation } from "./indent-retarget.js";
+import {
+  expectationFromToolInput,
+  noteAgentCallEnd,
+  noteAgentCallStart
+} from "./fix-run-restore.js";
 import { LANGUAGE_POLICY } from "./language-policy.js";
 import { isComplexitySupportedFile } from "./tree-sitter-shared.js";
 import {
@@ -24,7 +30,8 @@ import {
 } from "./mutating-tool.js";
 import { isProvisionalLearnedAttribution } from "./mutation-attribution.js";
 import { armObservedMutation } from "./observed-mutation.js";
-import { getLSPService } from "./lsp/index.js";
+import { extractWrittenPathsFromCommand } from "./bash-file-access.js";
+import { getLSPService } from "./lsp/capabilities.js";
 import {
   findDocumentSymbolAtLine,
   getOpenDocumentSymbols,
@@ -61,7 +68,10 @@ import {
   tryCorrectIndentationMismatchFromContent
 } from "./read-guard-tool-lines.js";
 import { handleToolResult } from "./runtime-tool-result.js";
-import { resolveToolCallCorrelationId } from "./tool-event.js";
+import {
+  resolveReadEvidenceCorrelationId,
+  resolveToolCallCorrelationId
+} from "./tool-event.js";
 import { getSharedTreeSitterClient } from "./tree-sitter-shared.js";
 const LSP_TOOLCALL_NAV_TOUCH_BUDGET_MS = Math.max(0, Number.parseInt(process.env.DM_LENS_TOOLCALL_NAV_TOUCH_MS ?? process.env.DM_LENS_LSP_NAV_CLIENT_WAIT_MS ?? "1500", 10) || 1500);
 const LSP_TOOLCALL_TOUCH_BUDGET_MS = Math.max(0, Number.parseInt(process.env.DM_LENS_TOOLCALL_TOUCH_MS ?? "750", 10) || 750);
@@ -102,6 +112,24 @@ function getToolCallRawFilePath(toolName, event) {
   }
   return;
 }
+function retireAstGrepApplyTargets(toolName, event, runtime, ctx) {
+  const input = event.input ?? {};
+  if (toolName !== "ast_grep_replace" || input.apply !== true)
+    return;
+  if (!Array.isArray(input.paths))
+    return;
+  const checked = [];
+  for (const rawPath of input.paths) {
+    if (typeof rawPath !== "string")
+      continue;
+    const resolved = resolveToolCallFilePath(rawPath, ctx.cwd, runtime.projectRoot)?.path;
+    if (!resolved)
+      continue;
+    runtime.readGuard?.retireChangedAuthorship?.(resolved);
+    checked.push(resolved);
+  }
+  runtime.readGuard?.noteCheckedPaths?.(resolveToolCallCorrelationId(event), checked);
+}
 function resolveToolCallFilePath(rawFilePath, cwd, projectRoot) {
   if (!rawFilePath)
     return;
@@ -115,7 +143,7 @@ function getReadToolInput(toolName, input) {
 function getEffectiveReadLimit(filePath, readInput) {
   if (!filePath || !readInput)
     return;
-  const requestedOffset = readInput.offset ?? 1;
+  const requestedOffset = Math.max(1, readInput.offset ?? 1);
   const requestedLimit = readInput.limit;
   return requestedLimit ?? Math.max(1, countFileLines(filePath) - requestedOffset + 1);
 }
@@ -199,6 +227,7 @@ export async function handleToolCall(deps) {
         if (toolCallId !== undefined) {
           deps.runtime.takeToolCallAttribution(toolCallId);
         }
+        noteAgentCallEnd(toolCallId);
       } catch (cleanupError) {
         const reason = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
         recordDegradationOnce({
@@ -274,11 +303,14 @@ async function handleToolCallImpl(deps) {
     return;
   if (toolName === "bash") {
     const commandInput = event.input;
+    if (typeof commandInput?.command === "string" && !getFlag("no-read-guard"))
+      for (const target of extractWrittenPathsFromCommand(commandInput.command, runtime.projectRoot || process.cwd()))
+        runtime.readGuard?.retireChangedAuthorship?.(target);
     if (typeof commandInput?.command === "string" && commandInput.command) {
       const scanRoot = ctx.cwd ?? runtime.projectRoot;
       if (scanRoot) {
         const started = Date.now();
-        const rootKey = `${normalizeMapKey(path.resolve(scanRoot))}:${runtime.sessionGeneration}`;
+        const baselineSlot = opaqueBaselineSlot(scanRoot, runtime.sessionGeneration);
         let baseline;
         let resultNote;
         if (await isGitWorktree(scanRoot)) {
@@ -299,7 +331,10 @@ async function handleToolCallImpl(deps) {
           };
           resultNote = outcome.unknownReason ?? `scanned:${outcome.scannedCount}`;
         }
-        getOpaqueBaselineStore().record(rootKey, baseline);
+        getOpaqueBaselineStore().record(baselineSlot, resolveToolCallCorrelationId(event), baseline, {
+          key: runtime.turnKey(deps.sessionId),
+          isLive: (key) => runtime.isLiveTurnKey(key)
+        });
         logLatency({
           type: "phase",
           phase: "opaque_mutation_prescan",
@@ -314,18 +349,30 @@ async function handleToolCallImpl(deps) {
     const observedRawPath = readMutationPathField(event);
     const observedPath = observedRawPath ? resolveToolCallFilePath(observedRawPath, ctx.cwd, runtime.projectRoot)?.path : undefined;
     if (observedPath) {
+      const observedCallId = resolveToolCallCorrelationId(event);
+      const retire = (target) => {
+        runtime.readGuard?.retireChangedAuthorship?.(target);
+      };
+      retire(observedPath);
+      runtime.readGuard?.noteCheckedPaths?.(observedCallId, [observedPath]);
       await armObservedMutation({
-        toolCallId: resolveToolCallCorrelationId(event),
+        toolCallId: observedCallId,
         toolName,
         targetPath: observedPath,
         cwd: ctx.cwd ?? runtime.projectRoot,
         sessionGeneration: runtime.sessionGeneration,
-        turnIndex: runtime.turnIndex,
+        turnIndex: runtime.turnKey(deps.sessionId),
+        isLiveTurn: (key) => runtime.isLiveTurnKey(key),
+        onUniverse: (paths) => {
+          paths.forEach(retire);
+          runtime.readGuard?.noteCheckedPaths?.(observedCallId, paths);
+        },
         signal: ctx.signal,
         dbg
       });
     }
   }
+  retireAstGrepApplyTargets(toolName, event, runtime, ctx);
   if (getFlag("lens-guard") && isGitCommitOrPushAttempt(toolName, event.input)) {
     const guard = evaluateGitGuard(runtime, cacheManager, ctx.cwd ?? runtime.projectRoot, ctx.host ?? "pi");
     if (guard.block) {
@@ -362,7 +409,7 @@ async function handleToolCallImpl(deps) {
     return;
   dbg(`tool_call fired for: ${filePath} (exists: ${nodeFs.existsSync(filePath)})`);
   const toolCallId = resolveToolCallCorrelationId(event);
-  const attributesMutationTarget = toolCallId !== undefined && mutation !== undefined;
+  const attributesMutationTarget = toolCallId !== undefined && (mutation !== undefined || toolName === "read");
   const targetMissing = !nodeFs.existsSync(filePath);
   const targetIgnored = isPathIgnoredByProject(filePath, runtime.projectRoot, false);
   if (attributesMutationTarget) {
@@ -371,6 +418,8 @@ async function handleToolCallImpl(deps) {
       skipped: targetIgnored,
       originCwd: ctx.cwd ?? runtime.projectRoot
     });
+    if (mutation !== undefined)
+      noteAgentCallStart(toolCallId, filePath, expectationFromToolInput(event.input, mutation.kind));
   }
   if (targetMissing) {
     if (mutation?.kind !== "write" && pathResolution?.unresolved) {
@@ -404,6 +453,7 @@ async function handleToolCallImpl(deps) {
   }
   if (shouldAutoTouch) {
     try {
+      const readStamp = performance.now();
       const fileContent = nodeFs.readFileSync(filePath, "utf-8");
       const maxClientWaitMs = toolName === "lsp_navigation" ? LSP_TOOLCALL_NAV_TOUCH_BUDGET_MS : LSP_TOOLCALL_TOUCH_BUDGET_MS;
       if (toolName === "read") {
@@ -414,7 +464,8 @@ async function handleToolCallImpl(deps) {
         diagnostics: "none",
         source: `tool_call:${toolName}`,
         clientScope: "primary",
-        maxClientWaitMs
+        maxClientWaitMs,
+        readStamp
       }).then((result) => {
         if (toolName === "read") {
           if (result === undefined) {
@@ -441,12 +492,14 @@ async function handleToolCallImpl(deps) {
     }
   }
   const readInput = getReadToolInput(toolName, event.input);
-  const requestedReadOffset = readInput?.offset ?? 1;
+  const requestedReadOffset = Math.max(1, readInput?.offset ?? 1);
   const requestedReadLimit = readInput?.limit;
   let effectiveReadOffset = requestedReadOffset;
   let effectiveReadLimit = getEffectiveReadLimit(filePath, readInput);
   let enclosingSymbol;
-  const readExpansionClient = toolName === "read" && !getFlag("no-lsp") && !isExternalOrVendor && filePath && readInput && requestedReadLimit != null && requestedReadLimit <= EXPANSION_LIMIT_LINES ? getTreeSitterClient() : null;
+  if (toolName === "read" && toolCallId !== undefined)
+    runtime.takeReadWidening(toolCallId);
+  const readExpansionClient = toolName === "read" && !getFlag("no-lsp") && !getFlag("no-read-guard") && !isExternalOrVendor && filePath && readInput && requestedReadLimit != null && requestedReadLimit <= EXPANSION_LIMIT_LINES ? getTreeSitterClient() : null;
   if (readExpansionClient && filePath && readInput && requestedReadLimit != null) {
     const totalLines = effectiveReadLimit != null && requestedReadLimit == null ? effectiveReadLimit : countFileLines(filePath);
     try {
@@ -478,6 +531,18 @@ async function handleToolCallImpl(deps) {
         } else {
           enclosingSymbol = expansion.enclosingSymbol;
         }
+        if (toolCallId !== undefined) {
+          runtime.recordReadWidening(toolCallId, {
+            filePath,
+            inputPath: rawFilePath,
+            requested: {
+              offset: requestedReadOffset,
+              limit: requestedReadLimit
+            },
+            shown: { offset: expansion.newOffset, limit: expansion.newLimit },
+            boundary: expansion.enclosingSymbol.kind === "markdown_section" ? { heading: expansion.enclosingSymbol.name } : { symbol: enclosingSymbol }
+          });
+        }
         logToolReadGuardEvent({
           event: "ts_range_expanded",
           sessionId: runtime.telemetrySessionId,
@@ -535,8 +600,8 @@ async function handleToolCallImpl(deps) {
       writeIndex: runtime.peekWriteIndex(),
       timestamp: Date.now(),
       provisional: true,
-      ...resolveToolCallCorrelationId(event) !== undefined && {
-        source: `native-read:${resolveToolCallCorrelationId(event)}:provisional`
+      ...toolCallId !== undefined && {
+        source: `native-read:${toolCallId}:provisional`
       }
     });
   }
@@ -569,7 +634,7 @@ async function handleToolCallImpl(deps) {
   const isEditOnly = mutation?.kind === "edit";
   const isWriteOrEdit = mutation !== undefined;
   if (!isEditOnly && isWriteOrEdit && event.toolName !== "bash" && filePath && !getFlag("no-read-guard")) {
-    runtime.readGuard.noteCreatedFile(filePath, runtime.turnIndex, runtime.peekWriteIndex());
+    runtime.readGuard.noteCreatedFile(filePath, runtime.turnIndex, runtime.peekWriteIndex(), resolveReadEvidenceCorrelationId(event));
   }
   if (isEditOnly && filePath) {
     const editInput = event.input;
@@ -741,9 +806,12 @@ async function handleToolCallImpl(deps) {
         partiallyApplicable,
         contentMatchValidated,
         editBatchSummary
-      } = getTouchedLinesForGuard(event, filePath, runtime.telemetrySessionId, readGuardCorrelationId, runtime.partialApplyRecords);
+      } = getTouchedLinesForGuard(event, filePath, runtime.telemetrySessionId, readGuardCorrelationId, runtime.partialApplyRecords, readGuard.contentMatchesLastRead(filePath));
       if (preflightError) {
         if (partiallyApplicable && partiallyApplicable.length > 0) {
+          const partialStamp = {
+            stampFileTime: readGuard.fileTimeMoved?.(filePath) !== true
+          };
           try {
             const partial = await applyPartiallyApplicableEdits({
               filePath,
@@ -778,6 +846,8 @@ async function handleToolCallImpl(deps) {
                   metricsClient,
                   resetLSPService,
                   readGuard: runtime.readGuard,
+                  sessionId: deps.sessionId,
+                  _ownWriteStamp: partialStamp,
                   agentBehaviorRecord: (toolName, analyzedPath) => agentBehaviorClient.recordToolCall(toolName, analyzedPath),
                   formatBehaviorWarnings: (warnings) => agentBehaviorClient.formatWarnings(warnings)
                 });
@@ -852,10 +922,13 @@ async function handleToolCallImpl(deps) {
           isExistingFile
         }
       });
+      const fileTimeMoved = readGuard.fileTimeMoved?.(filePath) === true;
       const verdict = typeof readGuard.checkEdit === "function" ? readGuard.checkEdit(filePath, touchedLines, editRanges, {
         skipSnapshotCheck: !!contentMatchValidated,
         oldTextResolved: !!contentMatchValidated
       }) : { action: "allow" };
+      if (fileTimeMoved && toolCallId !== undefined)
+        runtime.markToolCallFileTimeStale(toolCallId);
       if (verdict.relocation) {
         const relocated = relocateEditRange(event.input, verdict.relocation.from, verdict.relocation.to);
         if (relocated) {
@@ -891,6 +964,8 @@ async function handleToolCallImpl(deps) {
           block: true,
           reason: verdict.reason
         };
+      } else if (toolCallId !== undefined) {
+        runtime.markToolCallEditInPlace(toolCallId);
       }
     }
   }