@duckmind/dm-linux-x64 0.63.9 → 0.64.6

package/extensions/dm-lens/clients/runtime-turn.js

@@ -0,0 +1,2158 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import {
+  buildActionableWarningsReport,
+  formatActionableWarningsAdvisory,
+  publishActionableWarningsReport,
+  writeDeferredActionableWarningsReport
+} from "./actionable-warnings.js";
+import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
+import {
+  appendCodeQualityWarningsHistory,
+  buildCodeQualityWarningsReport,
+  formatCodeQualityWarningsAdvisory,
+  writeCodeQualityWarningsReport
+} from "./code-quality-warnings.js";
+import {
+  clearGitGuardTestFailure,
+  mergeGitGuardTestFailure,
+  writeGitGuardRecord
+} from "./git-guard.js";
+import { cascadeSettleWaitMs } from "./cascade-budget.js";
+import { logCascade } from "./cascade-logger.js";
+import { normalizeMapKey } from "./path-utils.js";
+import { compareOrdinal } from "./string-utils.js";
+import {
+  resolveRunnerPath,
+  toRunnerDisplayPath
+} from "./dispatch/runner-context.js";
+import { getKnipIgnorePatterns } from "./file-utils.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
+import {
+  getFullScanWallClockMs,
+  isWorkspaceSweepActive,
+  runWhenWorkspaceSweepIdle,
+  SWEEP_IDLE_SAFETY_MARGIN_MS
+} from "./lsp/workspace-sweep-hold.js";
+import { isTestRoleCollateral } from "./collateral-test-role.js";
+import {
+  dedupeSecretFindings,
+  fromAstGrepWarnings,
+  fromGitleaks,
+  fromTrivySecrets,
+  isSecretWarning,
+  secretLocationKey
+} from "./secret-findings.js";
+import {
+  deadCodeIssueKey,
+  deadCodeIssues,
+  formatDeadCodeDelta,
+  stableFindingKey
+} from "./dead-code-client.js";
+import { logDeadCodeScan } from "./dead-code-logger.js";
+import {
+  PROJECT_DIAGNOSTICS_CACHE_VERSION,
+  writeProjectDiagnosticsDeltaReport
+} from "./project-diagnostics/cache.js";
+import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
+import { gitleaksFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/gitleaks.js";
+import { govulncheckFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/govulncheck.js";
+import {
+  trivyFindingToProjectDiagnostic,
+  trivySecretFindingToProjectDiagnostic
+} from "./project-diagnostics/runner-adapters/trivy.js";
+import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
+import { applyDispositionsMultiFile } from "./diagnostic-dispositions.js";
+import { logLatency } from "./latency-logger.js";
+import {
+  getLspBudgetIdleTimeoutMs,
+  shouldShortenLspIdleTimeout
+} from "./lsp-budget.js";
+import { updateHeartbeat } from "./instance-registry.js";
+import { emitLensTurnFindings } from "./lens-events.js";
+import { RUNTIME_CONFIG } from "./runtime-config.js";
+import { isSubagentSession } from "./subagent-mode.js";
+import { formatRunDurationMs } from "./run-duration.js";
+import {
+  isExcludedTestTarget,
+  RUNNERS
+} from "./test-runner-client.js";
+import {
+  MAX_ADVISORY_AFFECTED_FILES,
+  gateFindingsByPathFreshness,
+  snapshotAdvisoryProvenance
+} from "./advisory-provenance.js";
+import {
+  DEPENDENCY_DRIFT_MAX_DELIVERIES,
+  sweepInlineBlockerFreshness
+} from "./blocker-freshness.js";
+import { sweepInlineBlockerPastEof } from "./blocker-past-eof.js";
+import { getLSPService } from "./lsp/index.js";
+import {
+  drainPendingAuxCapEvictedCount,
+  drainPendingAuxiliaryCoverage,
+  isPendingAuxiliaryPastRearmTtl,
+  rearmPendingAuxiliaryCoverage,
+  MAX_LATE_AUX_REARMS,
+  pendingAuxiliaryCoverageSize
+} from "./lsp/pending-aux-coverage.js";
+import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
+import {
+  drainPendingRunnerFindings,
+  dropStaleRunnerFindings,
+  pendingRunnerFindingsSize
+} from "./dispatch/pending-runner-findings.js";
+import {
+  incrementDegradationCount,
+  recordDegradationOnce
+} from "./degradation-ledger.js";
+import { mapWithConcurrency } from "./map-with-concurrency.js";
+import { getAmbientAbortSignal } from "./safe-spawn.js";
+import { emitBounded } from "./bounded-telemetry.js";
+import {
+  degradeDemotedFindingBody,
+  formatDeliveryCapNote,
+  formatRetirementNote
+} from "./demoted-finding-render.js";
+import { STALE_LINE_MARKER } from "./stale-marker.js";
+import { getActiveSessionId } from "./session-lifecycle.js";
+import {
+  drainRenderedDependencyDriftFilePaths,
+  getWidgetBlockingFilesForSweep,
+  incrementWidgetDependencyDriftDelivery,
+  markWidgetFileBlockersStale,
+  recordRunner,
+  retireWidgetDependencyDriftBlockers
+} from "./widget-state.js";
+const LATE_AUX_COVERAGE_GAP_DETAIL_CAP_PER_TURN = 20;
+export const TEST_RUNNER_BATCH_CONCURRENCY = 4;
+export const TEST_RUNNER_MAX_TARGETS = 12;
+export const TEST_RUNNER_BATCH_BUDGET_MS = 20000;
+export const TEST_RUNNER_MAX_DEFERRALS = 2;
+export const TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
+function deferralEntryKey(entry) {
+  return `${entry.sessionId ?? ""}\x00${normalizeMapKey(path.resolve(entry.testFile))}`;
+}
+function mergeDeferredTargets(existing, incoming) {
+  const byKey = new Map;
+  for (const entry of [...existing, ...incoming]) {
+    const key = deferralEntryKey(entry);
+    const prior = byKey.get(key);
+    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
+      continue;
+    byKey.set(key, entry);
+  }
+  return [...byKey.values()];
+}
+export async function runTestTargetsBounded(args) {
+  const results = [];
+  if (args.targets.length === 0)
+    return { results, deferred: [] };
+  let stopReason;
+  const batchAbort = new AbortController;
+  let closed = false;
+  const settledBeforeClose = new Set;
+  const budgetMs = Math.max(0, args.budgetMs);
+  const deadline = Date.now() + budgetMs;
+  const shouldStop = () => {
+    if (stopReason !== undefined)
+      return true;
+    if (args.signal?.aborted) {
+      stopReason = "abort";
+      return true;
+    }
+    if (Date.now() >= deadline) {
+      stopReason = "budget";
+      return true;
+    }
+    return false;
+  };
+  const pool = mapWithConcurrency(args.targets.map((target, index) => ({ target, index })), Math.max(1, args.concurrency), async ({ target, index }) => {
+    if (shouldStop())
+      return;
+    const running = args.run(target, batchAbort.signal);
+    const stamp = running.then((value) => {
+      if (closed)
+        return;
+      settledBeforeClose.add(index);
+      results.push({ status: "fulfilled", value });
+    }, (reason) => {
+      if (closed)
+        return;
+      settledBeforeClose.add(index);
+      results.push({ status: "rejected", reason });
+    });
+    await stamp;
+  });
+  pool.catch(() => {});
+  await new Promise((resolve) => {
+    let settled = false;
+    const finish = (reason) => {
+      if (settled)
+        return;
+      settled = true;
+      if (reason !== undefined)
+        stopReason ??= reason;
+      closed = true;
+      batchAbort.abort();
+      clearTimeout(timer);
+      args.signal?.removeEventListener("abort", onAbort);
+      resolve();
+    };
+    const onAbort = () => finish("abort");
+    const timer = setTimeout(() => finish("budget"), budgetMs);
+    timer.unref?.();
+    if (args.signal?.aborted)
+      finish("abort");
+    else
+      args.signal?.addEventListener("abort", onAbort, { once: true });
+    pool.then(() => finish(), () => finish());
+  });
+  return {
+    results,
+    deferred: args.targets.filter((_, index) => !settledBeforeClose.has(index)),
+    stopReason
+  };
+}
+function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
+  if (findings.length === 0)
+    return { kept: findings, suppressed: 0 };
+  const candidates = findings.map((finding) => ({
+    finding,
+    diagnostic: toDiagnostic(finding)
+  }));
+  const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.diagnostic), cwd, (d) => d.filePath));
+  const kept = candidates.filter((c) => survivors.has(c.diagnostic)).map((c) => c.finding);
+  return { kept, suppressed: findings.length - kept.length };
+}
+function wouldPoisonCache(prev, next) {
+  return !next.success && prev?.data.success === true;
+}
+let lspIdleResetTimeout = null;
+let pendingSweepRearm = null;
+function emitIdleResetReporterWarning(reportErr) {
+  try {
+    process.emitWarning(`dm-lens LSP idle reset error reporter failed: ${reportErr}`, { code: "DM_LENS_LSP_IDLE_RESET_REPORTER_FAILED" });
+  } catch {}
+}
+function reportIdleResetError(onError, err) {
+  try {
+    onError?.(err);
+  } catch (reportErr) {
+    emitIdleResetReporterWarning(reportErr);
+  }
+}
+function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
+  if (lspIdleResetTimeout) {
+    clearTimeout(lspIdleResetTimeout);
+  }
+  if (pendingSweepRearm) {
+    pendingSweepRearm.cancelled = true;
+    pendingSweepRearm = null;
+  }
+  lspIdleResetTimeout = setTimeout(() => {
+    lspIdleResetTimeout = null;
+    if (isWorkspaceSweepActive()) {
+      const rearmToken = { cancelled: false };
+      pendingSweepRearm = rearmToken;
+      runWhenWorkspaceSweepIdle(() => {
+        if (rearmToken.cancelled)
+          return;
+        if (pendingSweepRearm === rearmToken)
+          pendingSweepRearm = null;
+        scheduleLSPIdleReset(resetFn, delayMs, options);
+      });
+      return;
+    }
+    try {
+      if (options.isCurrentSession && !options.isCurrentSession()) {
+        return;
+      }
+      if (options.isPrimarySession && !options.isPrimarySession()) {
+        return;
+      }
+      resetFn();
+    } catch (err) {
+      reportIdleResetError(options.onError, err);
+    }
+  }, delayMs);
+  lspIdleResetTimeout.unref();
+}
+const DEFAULT_LSP_IDLE_RESET_MS = 240000;
+function sweepDerivedFloorMs() {
+  return getFullScanWallClockMs() + SWEEP_IDLE_SAFETY_MARGIN_MS;
+}
+function getBaseLspIdleResetMs() {
+  return Math.max(DEFAULT_LSP_IDLE_RESET_MS, sweepDerivedFloorMs());
+}
+function getShortenedLspIdleResetMs() {
+  return Math.max(getLspBudgetIdleTimeoutMs(), sweepDerivedFloorMs());
+}
+export function getEffectiveLspIdleResetMs() {
+  return isSubagentSession() || shouldShortenLspIdleTimeout() ? getShortenedLspIdleResetMs() : getBaseLspIdleResetMs();
+}
+export function cancelLSPIdleReset() {
+  if (lspIdleResetTimeout) {
+    clearTimeout(lspIdleResetTimeout);
+    lspIdleResetTimeout = null;
+  }
+  if (pendingSweepRearm) {
+    pendingSweepRearm.cancelled = true;
+    pendingSweepRearm = null;
+  }
+}
+function capTurnEndMessage(content) {
+  const maxLines = RUNTIME_CONFIG.turnEnd.maxLines;
+  const maxChars = RUNTIME_CONFIG.turnEnd.maxChars;
+  let out = content;
+  const lines = out.split(`
+`);
+  if (lines.length > maxLines) {
+    out = `${lines.slice(0, maxLines).join(`
+`)}
+... (truncated)`;
+  }
+  if (out.length > maxChars) {
+    out = `${out.slice(0, maxChars)}
+... (truncated)`;
+  }
+  return out;
+}
+export async function handleTurnEnd(deps) {
+  const {
+    ctxCwd,
+    getFlag,
+    dbg,
+    runtime,
+    cacheManager,
+    knipClient,
+    deadCodeClients,
+    depChecker,
+    testRunnerClient,
+    sessionId,
+    owner,
+    resetLSPService,
+    resetFormatService
+  } = deps;
+  updateHeartbeat().catch(() => {});
+  const cwd = ctxCwd ?? process.cwd();
+  let turnState = cacheManager.readTurnState(cwd);
+  const currentOwner = {
+    ...owner ?? {
+      kind: "pi",
+      id: runtime.telemetrySessionId,
+      pid: process.pid,
+      lastSeen: new Date().toISOString()
+    },
+    sessionStartedAt: owner?.sessionStartedAt ?? runtime.sessionStartedAt
+  };
+  const access = cacheManager.getTurnStateAccess(cwd, currentOwner);
+  const gateOwnerLabel = turnState.owner ? `${turnState.owner.kind}:${turnState.owner.id}` : turnState.sessionId ? `legacy:${turnState.sessionId}` : "none";
+  const sameProcessPiSessionHandoff = access === "foreign-live" && currentOwner.kind === "pi" && turnState.owner?.kind === "pi" && turnState.owner.pid === process.pid && turnState.owner.id !== currentOwner.id;
+  if (access === "foreign-live" && !sameProcessPiSessionHandoff) {
+    dbg(`turn_end: foreign live owner retained (${turnState.owner?.kind ?? "legacy"}:${turnState.owner?.id ?? turnState.sessionId})`);
+    return;
+  }
+  if (access === "available" && (turnState.files || turnState.owner || turnState.sessionId)) {
+    dbg("turn_end: evicting stale turn-state owner");
+    cacheManager.clearTurnState(cwd, currentOwner);
+    turnState = cacheManager.readTurnState(cwd);
+  }
+  const files = Object.keys(turnState.files);
+  let widgetDemotedFindingsRetired = 0;
+  for (const wPath of drainRenderedDependencyDriftFilePaths()) {
+    const deliveryCount = incrementWidgetDependencyDriftDelivery(wPath);
+    if (deliveryCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+      const capRetired = retireWidgetDependencyDriftBlockers(wPath);
+      if (capRetired) {
+        widgetDemotedFindingsRetired += 1;
+        incrementDegradationCount({
+          kind: "demoted-finding-retired",
+          subject: `widget-blocker:${toRunnerDisplayPath(cwd, wPath)}`,
+          reason: `capped after ${deliveryCount} deliveries with no re-run; hidden from the dm-lens footer, still listed by lens_diagnostics mode=all — re-run can still confirm`
+        });
+      }
+    }
+  }
+  if (files.length === 0 && !runtime.hasCascadeRuns()) {
+    if (getFlag("lens-guard") && !runtime.gitGuardHasBlockers) {
+      const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
+        cacheManager.clearCache("turn-end-findings", cwd);
+      }
+    }
+    const idleResetMs = getEffectiveLspIdleResetMs();
+    dbg(`turn_end: no modified files, scheduling LSP idle reset (${idleResetMs / 1000}s)`);
+    if (!getFlag("no-lsp")) {
+      const sessionGeneration = runtime.sessionGeneration;
+      scheduleLSPIdleReset(resetLSPService, idleResetMs, {
+        isCurrentSession: () => runtime.isCurrentSession(sessionGeneration),
+        isPrimarySession: () => {
+          const activePrimarySessionId = getActiveSessionId();
+          return activePrimarySessionId === undefined || activePrimarySessionId === runtime.telemetrySessionId;
+        },
+        onError: (err) => dbg(`lsp idle reset failed: ${err}`)
+      });
+    }
+    resetFormatService();
+    if (pendingRunnerFindingsSize() === 0)
+      return;
+  }
+  if (files.length > 0 && (lspIdleResetTimeout || pendingSweepRearm)) {
+    cancelLSPIdleReset();
+    dbg("turn_end: cancelled pending LSP idle reset (active editing)");
+  }
+  dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
+  if (cacheManager.isMaxCyclesExceeded(cwd)) {
+    dbg("turn_end: max cycles exceeded, clearing state and forcing through");
+    cacheManager.clearTurnState(cwd, currentOwner);
+    runtime.fixedThisTurn.clear();
+    resetFormatService();
+    return;
+  }
+  const turnEndStart = Date.now();
+  const blockerParts = [];
+  const staleSecretParts = [];
+  const advisoryParts = [];
+  const projectDiagnosticsDelta = [];
+  const projectDiagnosticsSources = new Set;
+  const blockerPastEofStart = Date.now();
+  const blockerPastEof = sweepInlineBlockerPastEof(runtime, cwd);
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "blocker_past_eof_sweep",
+    durationMs: Date.now() - blockerPastEofStart,
+    metadata: {
+      total: blockerPastEof.total,
+      checked: blockerPastEof.checked,
+      demoted: blockerPastEof.demoted
+    }
+  });
+  const blockerFreshnessStart = Date.now();
+  const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+    additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
+      filePath: row.filePath,
+      recordedAtMs: row.recordedAtMs,
+      demote: () => markWidgetFileBlockersStale(row.filePath, "dependency-drift")
+    }))
+  });
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "blocker_freshness_sweep",
+    durationMs: Date.now() - blockerFreshnessStart,
+    metadata: {
+      total: blockerFreshness.total,
+      kept: blockerFreshness.kept,
+      revalidated: blockerFreshness.revalidated,
+      alreadyStale: blockerFreshness.alreadyStale,
+      truncatedImports: blockerFreshness.truncatedImports
+    }
+  });
+  const unresolvedBlockers = runtime.getInlineBlockersSnapshot();
+  let demotedFindingsRetired = 0;
+  const pendingDependencyDriftDeliveries = [];
+  for (const {
+    filePath: bPath,
+    summary,
+    stale,
+    staleReason
+  } of unresolvedBlockers) {
+    const displayPath = toRunnerDisplayPath(cwd, bPath);
+    if (stale) {
+      const deadLines = blockerPastEof.deadLinesByPath.get(bPath) ?? [];
+      const degraded = degradeDemotedFindingBody(summary, { deadLines });
+      const retired = runtime.retireDemotedPastEofBlocker(bPath, deadLines);
+      let retirementNote;
+      if (retired) {
+        demotedFindingsRetired += 1;
+        incrementDegradationCount({
+          kind: "demoted-finding-retired",
+          subject: `inline-blocker:${displayPath}`,
+          reason: `file shrank past cited line(s) ${deadLines.join(", ")}; retired after one degraded delivery`
+        });
+        retirementNote = formatRetirementNote(deadLines);
+      } else if (staleReason === "dependency-drift") {
+        const tentativeCount = runtime.peekInlineBlockerStaleDeliveryCount(bPath) + 1;
+        if (tentativeCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+          retirementNote = formatDeliveryCapNote(tentativeCount);
+        }
+        pendingDependencyDriftDeliveries.push(() => {
+          const deliveryCount = runtime.incrementInlineBlockerStaleDelivery(bPath);
+          if (deliveryCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+            const capRetired = runtime.retireDemotedDependencyDriftBlocker(bPath);
+            if (capRetired) {
+              demotedFindingsRetired += 1;
+              incrementDegradationCount({
+                kind: "demoted-finding-retired",
+                subject: `inline-blocker:${displayPath}`,
+                reason: `capped after ${deliveryCount} deliveries with no re-run; re-run can still confirm`
+              });
+            }
+          }
+        });
+      }
+      advisoryParts.push(`${STALE_LINE_MARKER} ${displayPath}:
+${degraded.body}` + (retirementNote ? `
+${retirementNote}` : ""));
+    } else {
+      blockerParts.push(`Unresolved from this turn — ${displayPath}:
+${summary}`);
+    }
+  }
+  const cascadeSettleStart = Date.now();
+  const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true });
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "cascade_settle_wait",
+    durationMs: Date.now() - cascadeSettleStart,
+    metadata: { settled, timedOut }
+  });
+  const t0 = Date.now();
+  const cascadeRuns = runtime.consumeCascadeRuns().filter((run) => {
+    const originSeq = run.origin?.projectSeq;
+    const originTurn = run.origin?.turnSeq;
+    if (originSeq !== undefined) {
+      const changedSince = runtime.getFilesChangedSince(originSeq);
+      if (changedSince.length > 0) {
+        const changedSet = new Set(changedSince);
+        const primaryKey = normalizeMapKey(path.resolve(run.filePath));
+        const neighborKeys = [
+          ...(run.result?.neighbors ?? []).map((n) => n.filePath),
+          ...run.selectedNeighborPaths ?? []
+        ].map((filePath) => normalizeMapKey(path.resolve(filePath)));
+        const supersededByOwnFile = changedSet.has(primaryKey) || neighborKeys.some((k) => changedSet.has(k));
+        if (supersededByOwnFile) {
+          logCascade({
+            phase: "cascade_carry_over_drop",
+            filePath: run.filePath,
+            neighborCount: run.neighborCount,
+            diagnosticCount: run.diagnosticCount,
+            reason: "superseded_by_later_write",
+            metadata: {
+              originProjectSeq: originSeq,
+              projectSeq: runtime.projectSeq,
+              originTurnSeq: originTurn,
+              turnIndex: runtime.turnIndex,
+              carriedTurns: run.carriedTurns,
+              changedFiles: changedSince
+            }
+          });
+          return false;
+        }
+      }
+    }
+    return true;
+  });
+  const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+  const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files[0] ?? cwd;
+  if (cascadeResults.length > 0) {
+    const seen = new Map;
+    for (const result of cascadeResults) {
+      seen.set(normalizeMapKey(result.filePath), result);
+    }
+    const neighborOwner = new Map;
+    for (const result of [...seen.values()].reverse()) {
+      const pk = normalizeMapKey(result.filePath);
+      for (const n of result.neighbors) {
+        const nk = normalizeMapKey(n.filePath);
+        if (!neighborOwner.has(nk))
+          neighborOwner.set(nk, pk);
+      }
+    }
+    const parts = [];
+    let injectedNeighborCount = 0;
+    let injectedDiagnosticCount = 0;
+    let suppressedByOwnership = 0;
+    for (const result of seen.values()) {
+      const pk = normalizeMapKey(result.filePath);
+      const ownsAny = result.neighbors.some((n) => neighborOwner.get(normalizeMapKey(n.filePath)) === pk);
+      if (ownsAny && result.formatted) {
+        parts.push(result.formatted);
+        injectedNeighborCount += result.neighbors.length;
+        injectedDiagnosticCount += result.neighbors.reduce((s, n) => s + n.diagnostics.length, 0);
+      } else if (!ownsAny && result.formatted) {
+        suppressedByOwnership++;
+      }
+    }
+    const neighborFilesWithErrors = cascadeResults.flatMap((r) => r.neighbors).filter((n) => n.diagnostics.length > 0).map((n) => n.filePath);
+    const uniqueNeighborFiles = [...new Set(neighborFilesWithErrors)];
+    let testSuggestionCount = 0;
+    if (uniqueNeighborFiles.length > 0 && typeof testRunnerClient.suggestTestFiles === "function") {
+      const testSuggestions = testRunnerClient.suggestTestFiles(uniqueNeighborFiles, cwd);
+      testSuggestionCount = testSuggestions.length;
+      logCascade({
+        phase: "cascade_test_targets",
+        filePath: cascadeLogFilePath,
+        neighborCount: uniqueNeighborFiles.length,
+        metadata: {
+          neighborFiles: uniqueNeighborFiles.slice(0, 10),
+          suggestedTestFiles: testSuggestions.slice(0, 10).map((s) => s.testFile),
+          runner: testSuggestions[0]?.runner,
+          truncated: testSuggestions.length > 10,
+          zeroSuggestions: testSuggestions.length === 0
+        }
+      });
+      if (testSuggestions.length > 0) {
+        const testLines = testSuggestions.slice(0, 5).map((s) => `  ${toRunnerDisplayPath(cwd, s.testFile)} (${s.runner})`);
+        let testSection = `\uD83E\uDDEA Likely tests for affected neighbors:
+${testLines.join(`
+`)}`;
+        if (testSuggestions.length > 5) {
+          testSection += `
+  ... and ${testSuggestions.length - 5} more`;
+        }
+        parts.push(testSection);
+      }
+    }
+    if (parts.length > 0) {
+      const section = parts.join(`
+
+`);
+      blockerParts.push(section);
+      logCascade({
+        phase: "cascade_injected",
+        filePath: cascadeLogFilePath,
+        neighborCount: injectedNeighborCount,
+        diagnosticCount: injectedDiagnosticCount,
+        metadata: {
+          sectionChars: section.length,
+          testSuggestionCount,
+          suppressedByOwnership
+        }
+      });
+    }
+    logCascade({
+      phase: "cascade_turn_end",
+      filePath: cascadeLogFilePath,
+      neighborCount: cascadeResults.reduce((s, r) => s + r.neighbors.length, 0),
+      diagnosticCount: cascadeResults.reduce((s, r) => s + r.neighbors.reduce((ns, n) => ns + n.diagnostics.length, 0), 0),
+      metadata: {
+        fileCount: cascadeResults.length,
+        mergedResults: seen.size
+      }
+    });
+  }
+  const indeterminateRuns = cascadeRuns.filter((r) => r.indeterminate);
+  if (indeterminateRuns.length > 0) {
+    const buildAdvisory = (runs, frame) => {
+      if (runs.length === 0)
+        return;
+      const byDetail = new Map;
+      for (const r of runs) {
+        const detail = r.indeterminate?.detail ?? frame.fallbackDetail(r);
+        const files = byDetail.get(detail) ?? [];
+        files.push(toRunnerDisplayPath(cwd, r.filePath));
+        byDetail.set(detail, files);
+      }
+      const lines = [];
+      for (const [detail, filesRaw] of byDetail) {
+        const files = [...new Set(filesRaw)];
+        const shown = files.slice(0, 5).join(", ");
+        const more = files.length > 5 ? ` (+${files.length - 5} more)` : "";
+        lines.push(`  • ${detail}: ${shown}${more}`);
+      }
+      const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath))).size;
+      const reasons = [...byDetail.keys()].join("; ");
+      return `${frame.lead(fileCount, reasons)}
+${lines.join(`
+`)}`;
+    };
+    const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" && r.indeterminate?.reason !== "excluded_by_role" && r.indeterminate?.reason !== "budget_truncated" && r.indeterminate?.budget === undefined);
+    const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" && r.indeterminate?.budget === undefined);
+    const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" || r.indeterminate?.budget !== undefined);
+    const graphAdvisory = buildAdvisory(graphRuns, {
+      lead: (fileCount, reasons) => `Cascade could not compute downstream impact for ${fileCount} edited file(s) this turn — ` + `the review graph was unavailable (${reasons}), so their dependents were not ` + `cascade-checked and a clean cascade result does not cover them.`,
+      fallbackDetail: (r) => r.indeterminate?.reason === "missing_node" ? "changed file not in the review graph" : "review graph unavailable"
+    });
+    if (graphAdvisory)
+      advisoryParts.push(graphAdvisory);
+    const bindingAdvisory = buildAdvisory(bindingRuns, {
+      lead: (fileCount, reasons) => `Cascade identified dependents for ${fileCount} edited file(s) this turn, but their ` + `diagnostics could not be freshly confirmed (${reasons}) and were withheld — a clean ` + `cascade result does not cover them.`,
+      fallbackDetail: () => "cascade diagnostics withheld (binding rejected)"
+    });
+    if (bindingAdvisory)
+      advisoryParts.push(bindingAdvisory);
+    const budgetAdvisory = buildAdvisory(budgetRuns, {
+      lead: (fileCount, reasons) => `Cascade checked the selected neighbors for ${fileCount} edited file(s) this turn, ` + `but some eligible dependents were not checked because the cascade budget ` + `was exhausted (${reasons}); a clean cascade result does not cover them.`,
+      fallbackDetail: (r) => {
+        const budget = r.indeterminate?.budget;
+        if (!budget)
+          return "cascade budget omitted eligible dependents";
+        const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
+        return budget.transitiveTruncated ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated` : detail;
+      }
+    });
+    if (budgetAdvisory)
+      advisoryParts.push(budgetAdvisory);
+    const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
+    const byFile = indeterminateRuns.map((r) => ({
+      file: toRunnerDisplayPath(cwd, r.filePath),
+      reason: r.indeterminate?.reason,
+      ...r.indeterminate?.detail && { detail: r.indeterminate.detail },
+      ...r.indeterminate?.budget && { budget: r.indeterminate.budget },
+      ...r.indeterminate?.diagnostic && {
+        diagnostic: r.indeterminate.diagnostic
+      }
+    }));
+    logCascade({
+      phase: "cascade_indeterminate",
+      filePath: indeterminateRuns[0]?.filePath ?? files[0] ?? cwd,
+      metadata: {
+        fileCount,
+        reasons: indeterminateRuns.map((r) => r.indeterminate?.reason),
+        byFile: byFile.slice(0, 20),
+        ...byFile.length > 20 && { byFileTruncated: byFile.length - 20 }
+      }
+    });
+  }
+  const cascadeSkipped = {
+    blockers: 0,
+    non_code: 0,
+    no_neighbors: 0,
+    clean: 0,
+    indeterminate: 0,
+    error: 0
+  };
+  for (const r of cascadeRuns) {
+    if (r.skipReason)
+      cascadeSkipped[r.skipReason] = (cascadeSkipped[r.skipReason] ?? 0) + 1;
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "cascade_merge",
+    durationMs: Date.now() - t0,
+    metadata: {
+      runsTotal: cascadeRuns.length,
+      resultCount: cascadeResults.length,
+      neighborCount: cascadeRuns.reduce((s, r) => s + r.neighborCount, 0),
+      diagnosticCount: cascadeRuns.reduce((s, r) => s + r.diagnosticCount, 0),
+      skipped: cascadeSkipped
+    }
+  });
+  const t2 = Date.now();
+  let knipMeta = {};
+  if (runtime.isStartupScanInFlight("knip")) {
+    dbg("turn_end: skipping knip (startup scan still in flight)");
+    knipMeta = { skipped: true };
+  } else {
+    const prevKnip = cacheManager.readCache("knip", cwd);
+    const previousFailedHard = prevKnip && !prevKnip.data.success && !prevKnip.data.failureKind && /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prevKnip.data.summary);
+    if (previousFailedHard) {
+      dbg(`turn_end: skipping knip after recent failure: ${prevKnip.data.summary}`);
+      knipMeta = { skipped: true, reason: prevKnip.data.summary };
+    } else {
+      const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns(), {
+        projectSeq: runtime.projectSeq
+      });
+      const knipWouldPoison = wouldPoisonCache(prevKnip, knipResult);
+      if (knipWouldPoison) {
+        dbg(`turn_end: keeping last good knip cache; this run failed: ${knipResult.summary}`);
+      } else {
+        cacheManager.writeCache("knip", knipResult, cwd);
+      }
+      knipMeta = {
+        execution: knipResult.execution ?? "executed",
+        success: knipResult.success,
+        totalIssues: knipResult.issues.length,
+        newIssues: 0,
+        blockerIssues: 0,
+        ...!knipResult.success && { reason: knipResult.summary },
+        ...knipResult.failureKind && { failureKind: knipResult.failureKind },
+        ...knipWouldPoison && { cacheKept: true }
+      };
+      if (knipResult.success && knipResult.issues.length > 0) {
+        const issueKey = (i) => stableFindingKey(i.type, i.file, i.name, i.package);
+        const prevKeys = new Set((prevKnip?.data?.issues ?? []).map(issueKey));
+        const modifiedSet = new Set(files.map((f) => resolveRunnerPath(cwd, f)));
+        const newIssues = knipResult.issues.filter((issue) => {
+          if (prevKeys.has(issueKey(issue)))
+            return false;
+          if (!issue.file)
+            return false;
+          const abs = resolveRunnerPath(cwd, issue.file);
+          return modifiedSet.has(abs);
+        });
+        knipMeta.newIssues = newIssues.length;
+        if (newIssues.length > 0) {
+          projectDiagnosticsDelta.push(...knipIssuesToProjectDiagnostics(cwd, newIssues));
+          projectDiagnosticsSources.add("knip");
+        }
+        const blockerIssues = newIssues.filter((i) => i.type === "unlisted" || i.type === "bin");
+        knipMeta.blockerIssues = blockerIssues.length;
+        if (blockerIssues.length > 0) {
+          let report = `\uD83D\uDD34 New unresolved imports/deps in modified code (Knip):
+`;
+          let firstPath = null;
+          for (const issue of blockerIssues.slice(0, 5)) {
+            const display = issue.file ? toRunnerDisplayPath(cwd, issue.file) : "(unknown)";
+            if (!firstPath && display !== "(unknown)")
+              firstPath = display;
+            report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.type}: ${issue.name}
+`;
+          }
+          if (firstPath) {
+            report += `  First location: ${firstPath}
+`;
+          }
+          blockerParts.push(report);
+        }
+        const unusedExportDelta = newIssues.filter((i) => i.type === "export" || i.type === "enumMember");
+        if (unusedExportDelta.length > 0) {
+          let report = `⚠️ Newly unused exports in files you edited — check if callers need updating (Knip):
+`;
+          for (const issue of unusedExportDelta.slice(0, 5)) {
+            const display = issue.file ? toRunnerDisplayPath(cwd, issue.file) : "(unknown)";
+            report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.name}
+`;
+          }
+          advisoryParts.push(report);
+        }
+      }
+    }
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "knip",
+    durationMs: Date.now() - t2,
+    metadata: knipMeta
+  });
+  const tDeadCode = Date.now();
+  const deadCodeMeta = {};
+  if (runtime.isStartupScanInFlight("dead-code")) {
+    dbg("turn_end: skipping dead-code (startup scan still in flight)");
+    deadCodeMeta.skipped = true;
+    deadCodeMeta.reason = "startup_scan_in_flight";
+  } else if (deadCodeClients.length === 0) {
+    deadCodeMeta.reason = "no_clients";
+  } else {
+    let modifiedSet = null;
+    const modifiedFiles = () => modifiedSet ??= new Set(files.map((f) => resolveRunnerPath(cwd, f)));
+    let newIssueTotal = 0;
+    const reasons = [];
+    try {
+      for (const client of deadCodeClients) {
+        if (!client.detect(cwd)) {
+          reasons.push(`${client.id}:not_detected`);
+          continue;
+        }
+        if (![...modifiedFiles()].some((f) => client.owns(f))) {
+          reasons.push(`${client.id}:no_owned_files`);
+          continue;
+        }
+        const cacheKey = `dead-code-${client.id}`;
+        const prev = cacheManager.readCache(cacheKey, cwd);
+        if (prev && !prev.data.success && /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prev.data.summary)) {
+          dbg(`turn_end: skipping dead-code after failure: ${prev.data.summary}`);
+          deadCodeMeta.skipped = true;
+          reasons.push(`${client.id}:backoff:${prev.data.summary}`);
+          continue;
+        }
+        const startMs = Date.now();
+        try {
+          const result = await client.analyze(cwd);
+          const durationMs = Date.now() - startMs;
+          if (wouldPoisonCache(prev, result)) {
+            dbg(`turn_end: keeping last good dead-code(${client.id}) cache; this run failed: ${result.summary}`);
+            deadCodeMeta.cacheKept = true;
+          } else {
+            cacheManager.writeCache(cacheKey, result, cwd, {
+              scanDurationMs: durationMs
+            });
+          }
+          logDeadCodeScan({
+            language: client.language,
+            success: result.success,
+            cached: false,
+            unusedExports: result.unusedExports.length,
+            unusedFiles: result.unusedFiles.length,
+            unusedDeps: result.unusedDeps.length,
+            unlistedDeps: result.unlistedDeps.length,
+            durationMs: result.durationMs ?? durationMs,
+            ...!result.success && { reason: result.summary }
+          });
+          deadCodeMeta.success = result.success;
+          if (!result.success) {
+            reasons.push(`${client.id}:scan_failed:${result.summary}`);
+            continue;
+          }
+          deadCodeMeta.totalIssues = (deadCodeMeta.totalIssues ?? 0) + deadCodeIssues(result).length;
+          if (!prev?.data.success) {
+            reasons.push(`${client.id}:no_previous_scan`);
+            continue;
+          }
+          const prevKeys = new Set(deadCodeIssues(prev.data).map(deadCodeIssueKey));
+          const modified = modifiedFiles();
+          const newIssues = deadCodeIssues(result).filter((issue) => {
+            if (prevKeys.has(deadCodeIssueKey(issue)))
+              return false;
+            if (!issue.file)
+              return false;
+            return modified.has(resolveRunnerPath(cwd, issue.file));
+          });
+          if (newIssues.length === 0) {
+            reasons.push(`${client.id}:clean`);
+            continue;
+          }
+          newIssueTotal += newIssues.length;
+          projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
+          projectDiagnosticsSources.add("dead-code");
+          advisoryParts.push(formatDeadCodeDelta(newIssues, result.language));
+        } catch (err) {
+          dbg(`turn_end: dead-code(${client.id}) failed: ${err}`);
+          reasons.push(`${client.id}:threw`);
+        }
+      }
+    } catch (err) {
+      dbg(`turn_end: dead-code block failed: ${err}`);
+      reasons.push("block_threw");
+    }
+    deadCodeMeta.newIssues = newIssueTotal;
+    if (reasons.length > 0)
+      deadCodeMeta.reason = reasons.join(",");
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "dead-code",
+    durationMs: Date.now() - tDeadCode,
+    metadata: deadCodeMeta
+  });
+  let dispositionSuppressedTotal = 0;
+  const dispositionSuppressedByLane = {};
+  function recordDispositionSuppressed(lane, count) {
+    if (count <= 0)
+      return;
+    dispositionSuppressedTotal += count;
+    dispositionSuppressedByLane[lane] = (dispositionSuppressedByLane[lane] ?? 0) + count;
+  }
+  const govCacheEntry = cacheManager.readCache("govulncheck", cwd);
+  const govGate = gateFindingsByPathFreshness({
+    store: "govulncheck",
+    findings: govCacheEntry?.data?.findings ?? [],
+    cwd,
+    scannedAt: govCacheEntry?.data?.scannedAt,
+    citedPath: (finding) => finding.trace.find((t) => t.filename)?.filename,
+    onMissing: "demote"
+  });
+  const govStale = new Set(govGate.stale);
+  const govFiltered = filterFindingsByDisposition([...govGate.live, ...govGate.stale], cwd, (f) => govulncheckFindingToProjectDiagnostic(cwd, f));
+  recordDispositionSuppressed("govulncheck", govFiltered.suppressed);
+  const govFindings = govFiltered.kept;
+  if (govFindings.length) {
+    const findings = govFindings.slice(0, 5);
+    let report = `\uD83D\uDEE1️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:
+`;
+    for (const f of findings) {
+      const callSite = f.trace.find((t) => t.filename);
+      const stale = govStale.has(f);
+      const where = callSite?.filename ? `${toRunnerDisplayPath(cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}` : f.module ?? f.packageName ?? "(module)";
+      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
+      report += `  ${f.osv} (${where})${fix}
+`;
+    }
+    if (govFindings.length > findings.length) {
+      report += `  … and ${govFindings.length - findings.length} more
+`;
+    }
+    advisoryParts.push(report);
+  }
+  const trivyCacheEntry = cacheManager.readCache("trivy", cwd);
+  const gitleaksData = cacheManager.readCache("gitleaks", cwd)?.data;
+  const trivySecretsData = trivyCacheEntry?.data;
+  const gitleaksGate = gateFindingsByPathFreshness({
+    store: "gitleaks",
+    findings: gitleaksData?.findings ?? [],
+    cwd,
+    scannedAt: gitleaksData?.scannedAt,
+    citedPath: (finding) => finding.file
+  });
+  const trivySecretsGate = gateFindingsByPathFreshness({
+    store: "trivy-secrets",
+    findings: trivySecretsData?.secrets ?? [],
+    cwd,
+    scannedAt: trivySecretsData?.scannedAt,
+    citedPath: (finding) => finding.file
+  });
+  const gitleaksLiveFiltered = filterFindingsByDisposition(gitleaksGate.live, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+  const gitleaksStaleFiltered = filterFindingsByDisposition(gitleaksGate.stale, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+  recordDispositionSuppressed("gitleaks", gitleaksLiveFiltered.suppressed + gitleaksStaleFiltered.suppressed);
+  const trivySecretsLiveFiltered = filterFindingsByDisposition(trivySecretsGate.live, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+  const trivySecretsStaleFiltered = filterFindingsByDisposition(trivySecretsGate.stale, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+  recordDispositionSuppressed("trivy-secrets", trivySecretsLiveFiltered.suppressed + trivySecretsStaleFiltered.suppressed);
+  const astSecretWarnings = runtime.peekActionableWarnings().filter(isSecretWarning);
+  const sessionSecrets = dedupeSecretFindings([
+    ...fromGitleaks(gitleaksLiveFiltered.kept),
+    ...fromTrivySecrets(trivySecretsLiveFiltered.kept)
+  ]);
+  const staleSecretEntries = [
+    ...gitleaksStaleFiltered.kept.map((f) => ({
+      file: toRunnerDisplayPath(cwd, f.file),
+      rule: f.ruleId,
+      source: "gitleaks"
+    })),
+    ...trivySecretsStaleFiltered.kept.map((f) => ({
+      file: toRunnerDisplayPath(cwd, f.file),
+      rule: f.ruleId,
+      source: "trivy"
+    }))
+  ];
+  const staleSecrets = [
+    ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values()
+  ];
+  const secretBlockedLocations = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
+  if (sessionSecrets.length) {
+    const enriched = dedupeSecretFindings([
+      ...sessionSecrets,
+      ...fromAstGrepWarnings(astSecretWarnings).filter((a) => secretBlockedLocations.has(secretLocationKey(a.file, a.line)))
+    ]);
+    const shown = enriched.slice(0, 5);
+    let report = `\uD83D\uDD34 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:
+`;
+    for (const f of shown) {
+      const where = `${toRunnerDisplayPath(cwd, f.file)}:${f.line}`;
+      report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}
+`;
+    }
+    if (enriched.length > shown.length) {
+      report += `  … and ${enriched.length - shown.length} more
+`;
+    }
+    blockerParts.push(report);
+  }
+  if (staleSecrets.length) {
+    const shown = staleSecrets.slice(0, 5);
+    let report = `\uD83D\uDD11 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}
+` + `The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:
+`;
+    for (const entry of shown) {
+      report += `  ${entry.file} — ${entry.rule} [${entry.source}]
+`;
+    }
+    if (staleSecrets.length > shown.length) {
+      report += `  … and ${staleSecrets.length - shown.length} more
+`;
+    }
+    staleSecretParts.push(report);
+  }
+  const trivyAgeLabel = formatCacheAgeLabel(trivyCacheEntry?.data?.scannedAt);
+  const trivyFindingsFiltered = filterFindingsByDisposition(trivyCacheEntry?.data?.findings ?? [], cwd, (f) => trivyFindingToProjectDiagnostic(cwd, f));
+  recordDispositionSuppressed("trivy", trivyFindingsFiltered.suppressed);
+  if (trivyFindingsFiltered.kept.length) {
+    const all = trivyFindingsFiltered.kept;
+    const critical = all.filter((f) => f.severity === "CRITICAL");
+    const advisory = all.filter((f) => f.severity !== "CRITICAL");
+    const fmt = (f) => {
+      const pkg = f.installedVersion ? `${f.pkgName}@${f.installedVersion}` : f.pkgName;
+      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
+      return `  ${f.vulnerabilityId} (${pkg})${fix}
+`;
+    };
+    if (critical.length) {
+      const shown = critical.slice(0, 5);
+      let report = `\uD83D\uDD34 STOP — CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}). Upgrade before shipping:
+`;
+      for (const f of shown)
+        report += fmt(f);
+      if (critical.length > shown.length) {
+        report += `  … and ${critical.length - shown.length} more
+`;
+      }
+      blockerParts.push(report);
+    }
+    if (advisory.length) {
+      const shown = advisory.slice(0, 5);
+      let report = `\uD83D\uDEE1️ Dependency CVEs (trivy, ${trivyAgeLabel}) — upgrade where possible:
+`;
+      for (const f of shown)
+        report += fmt(f);
+      if (advisory.length > shown.length) {
+        report += `  … and ${advisory.length - shown.length} more
+`;
+      }
+      advisoryParts.push(report);
+    }
+  }
+  const licenses = trivyCacheEntry?.data?.licenses ?? [];
+  if (licenses.length) {
+    const shown = licenses.slice(0, 5);
+    let report = `\uD83D\uDCDC Dependency license risk (trivy, ${trivyAgeLabel}) — review for compliance:
+`;
+    for (const l of shown) {
+      const cat = l.category ? `, ${l.category}` : "";
+      report += `  ${l.pkgName} — ${l.license} (${l.severity}${cat})
+`;
+    }
+    if (licenses.length > shown.length) {
+      report += `  … and ${licenses.length - shown.length} more
+`;
+    }
+    advisoryParts.push(report);
+  }
+  if (dispositionSuppressedTotal > 0) {
+    const byLane = Object.entries(dispositionSuppressedByLane).map(([lane, count]) => `${lane} ${count}`).join(", ");
+    advisoryParts.push(`suppressed by disposition: ${dispositionSuppressedTotal} finding(s) ` + `dropped from this turn's gitleaks/govulncheck/trivy sections (${byLane}) ` + "(marked false-positive or won't-fix).");
+  }
+  const t3 = Date.now();
+  let madgeStats;
+  if (getFlag("lens-turn-end-madge") && await depChecker.ensureAvailable()) {
+    const madgeFiles = cacheManager.getFilesForMadge(cwd);
+    if (madgeFiles.length > 0) {
+      dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
+      const absFiles = madgeFiles.map((file) => path.resolve(cwd, file));
+      const batch = await depChecker.checkFilesBatch(absFiles, cwd);
+      const depResults = batch.results;
+      madgeStats = batch.stats;
+      for (const file of madgeFiles) {
+        const absPath = path.resolve(cwd, file);
+        const depResult = depResults.get(absPath);
+        if (!depResult)
+          continue;
+        if (depResult.localSkips && depResult.localSkips > 0) {
+          dbg(`turn_end: madge skipped ${depResult.localSkips} local file(s) resolving ${file} — possible silent cycle-miss`);
+        }
+        if (depResult.hasCircular && depResult.circular.length > 0) {
+          dbg(`turn_end: circular dependency note for ${file} (suppressed in blockers-only mode)`);
+        }
+      }
+    }
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "madge",
+    durationMs: Date.now() - t3,
+    metadata: madgeStats ?? { skipped: true }
+  });
+  if (!getFlag("no-tests") && files.length > 0) {
+    const seen = new Set;
+    const targets = [];
+    const candidates = [];
+    const seenCandidateKeys = new Set;
+    for (const file of files) {
+      const abs = resolveRunnerPath(cwd, file);
+      const key = normalizeMapKey(abs);
+      if (seenCandidateKeys.has(key))
+        continue;
+      seenCandidateKeys.add(key);
+      candidates.push({ display: file, abs, isNeighbor: false });
+    }
+    for (const result of cascadeResults) {
+      for (const neighbor of result.neighbors) {
+        const abs = path.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
+        const key = normalizeMapKey(abs);
+        if (seenCandidateKeys.has(key))
+          continue;
+        seenCandidateKeys.add(key);
+        candidates.push({ display: neighbor.filePath, abs, isNeighbor: true });
+      }
+    }
+    const priorTestCache = cacheManager.readCache("test-runner-findings", cwd)?.data;
+    const carriedDeferred = priorTestCache?.deferredTargets ?? [];
+    const turnSessionId = sessionId ?? runtime.telemetrySessionId;
+    const isThisSession = (entry) => entry.sessionId === turnSessionId;
+    const entryPathKey = (entry) => normalizeMapKey(path.resolve(cwd, entry.testFile));
+    const retiredCarry = (priorTestCache?.retiredTargets ?? []).filter(isThisSession);
+    const retiredKeys = new Set(retiredCarry.map(entryPathKey));
+    const resolvedDeferralKeys = new Set;
+    const heldDeferred = [];
+    const boundPersisted = (entries, label) => {
+      const ordered = [
+        ...entries.filter((entry) => !isThisSession(entry)),
+        ...entries.filter(isThisSession)
+      ];
+      if (ordered.length <= TEST_RUNNER_MAX_PERSISTED_TARGETS)
+        return ordered;
+      dbg(`turn_end: ${label} test target list held ${ordered.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
+      return ordered.slice(-TEST_RUNNER_MAX_PERSISTED_TARGETS);
+    };
+    const writeTestFindings = (record, ownDeferred) => {
+      const live = cacheManager.readCache("test-runner-findings", cwd)?.data;
+      const own = mergeDeferredTargets(heldDeferred, ownDeferred);
+      const ownKeys = new Set(own.map(entryPathKey));
+      const merged = mergeDeferredTargets(live?.deferredTargets ?? [], own).filter((entry) => {
+        if (!isThisSession(entry))
+          return true;
+        const key = entryPathKey(entry);
+        return !resolvedDeferralKeys.has(key) || ownKeys.has(key);
+      });
+      cacheManager.writeCache("test-runner-findings", {
+        ...record,
+        deferredTargets: boundPersisted(merged, "deferred"),
+        retiredTargets: boundPersisted(mergeDeferredTargets(live?.retiredTargets ?? [], retiredCarry), "retired")
+      }, cwd);
+    };
+    let deadDeferred = 0;
+    let heldOverCap = 0;
+    let foreignDeferred = 0;
+    let redispatchedDeferred = 0;
+    let retiredThisTurn = 0;
+    for (const carried of carriedDeferred) {
+      const testFile = path.resolve(cwd, carried.testFile);
+      const carriedKey = normalizeMapKey(testFile);
+      if (!isThisSession(carried)) {
+        foreignDeferred++;
+        continue;
+      }
+      if (seen.has(carriedKey)) {
+        resolvedDeferralKeys.add(carriedKey);
+        continue;
+      }
+      const attempts = carried.attempts ?? 0;
+      if (attempts >= TEST_RUNNER_MAX_DEFERRALS) {
+        resolvedDeferralKeys.add(carriedKey);
+        if (!retiredKeys.has(carriedKey)) {
+          retiredKeys.add(carriedKey);
+          retiredThisTurn++;
+          retiredCarry.push({
+            testFile,
+            runner: carried.runner,
+            attempts,
+            sessionId: turnSessionId
+          });
+          incrementDegradationCount({
+            kind: "test-runner-batch-capped",
+            subject: `${cwd}:deferral-exhausted`,
+            reason: `test target ${path.relative(cwd, testFile)} was cut at the turn-end batch budget ${attempts} turn(s) running and is retired from turn-end selection for the rest of this session — too slow for a per-turn batch, run it explicitly`
+          });
+          dbg(`turn_end: retiring deferred test target ${path.relative(cwd, testFile)} after ${attempts} cut batch(es) — too slow for the turn-end budget, run it explicitly`);
+        }
+        continue;
+      }
+      const config = RUNNERS[carried.runner];
+      if (!config || isExcludedTestTarget(testFile, cwd) || !fs.existsSync(testFile)) {
+        resolvedDeferralKeys.add(carriedKey);
+        deadDeferred++;
+        continue;
+      }
+      if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
+        heldOverCap++;
+        heldDeferred.push({
+          testFile,
+          runner: carried.runner,
+          attempts,
+          sessionId: turnSessionId
+        });
+        continue;
+      }
+      resolvedDeferralKeys.add(carriedKey);
+      seen.add(carriedKey);
+      redispatchedDeferred++;
+      targets.push({
+        testFile,
+        runner: carried.runner,
+        config,
+        strategy: "deferred",
+        deferralAttempts: attempts
+      });
+      dbg(`turn_end: re-running deferred test target ${path.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
+    }
+    if (deadDeferred > 0) {
+      dbg(`turn_end: dropped ${deadDeferred} deferred test target(s) that no longer resolve (missing file, excluded, or unknown runner)`);
+    }
+    if (heldOverCap > 0) {
+      dbg(`turn_end: held ${heldOverCap} deferred test target(s) over the per-turn cap of ${TEST_RUNNER_MAX_TARGETS} — kept on the deferral list for the next turn, attempts unchanged`);
+    }
+    if (foreignDeferred > 0) {
+      dbg(`turn_end: ignored ${foreignDeferred} deferred test target(s) belonging to another session — left on the record for the session that cut them`);
+    }
+    if (carriedDeferred.length > 0) {
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "test_runner_deferral",
+        durationMs: 0,
+        metadata: {
+          carried: carriedDeferred.length,
+          redispatched: redispatchedDeferred,
+          heldOverCap,
+          retired: retiredThisTurn,
+          dropped: deadDeferred,
+          foreignSession: foreignDeferred,
+          sessionId: turnSessionId
+        }
+      });
+    }
+    let overCapTargets = 0;
+    let missingTargetFiles = 0;
+    let excludedTargets = 0;
+    let retiredSkips = 0;
+    for (const { display, abs, isNeighbor } of candidates) {
+      const target = testRunnerClient.getTestRunTarget(abs, cwd, runtime.turnIndex);
+      const targetKey = target ? normalizeMapKey(target.testFile) : "";
+      if (target && !seen.has(targetKey)) {
+        seen.add(targetKey);
+        if (retiredKeys.has(targetKey)) {
+          retiredSkips++;
+          dbg(`turn_end: ${display} → test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (isExcludedTestTarget(target.testFile, cwd)) {
+          excludedTargets++;
+          dbg(`turn_end: ${display} → test target excluded (integration/e2e), skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (!fs.existsSync(target.testFile)) {
+          missingTargetFiles++;
+          dbg(`turn_end: ${display} → test file missing, skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
+          overCapTargets++;
+          continue;
+        }
+        targets.push(target);
+        dbg(`turn_end: ${display} → test ${target.runner} ${path.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
+      } else if (!target) {
+        dbg(`turn_end: ${display} → no test file found${isNeighbor ? " (cascade-neighbor)" : ""}`);
+      }
+    }
+    if (excludedTargets > 0) {
+      dbg(`turn_end: excluded ${excludedTargets} test target(s) under the built-in integration/e2e exclusion list`);
+    }
+    if (retiredSkips > 0) {
+      dbg(`turn_end: skipped ${retiredSkips} test target(s) retired earlier this session for outrunning the turn-end batch budget`);
+    }
+    if (missingTargetFiles > 0) {
+      dbg(`turn_end: skipped ${missingTargetFiles} test target(s) whose file no longer exists`);
+    }
+    if (overCapTargets > 0) {
+      recordDegradationOnce({
+        kind: "test-runner-batch-capped",
+        subject: cwd,
+        reason: `turn touched more test targets than one turn may fire; ran ${TEST_RUNNER_MAX_TARGETS}, skipped ${overCapTargets} — re-run the remainder with lens_diagnostics or edit them in a smaller batch`
+      });
+      dbg(`turn_end: test target count capped at ${TEST_RUNNER_MAX_TARGETS}, ${overCapTargets} skipped`);
+    }
+    if (targets.length > 0) {
+      dbg(`turn_end: firing ${targets.length} test target(s) async (non-blocking, max ${TEST_RUNNER_BATCH_CONCURRENCY} concurrent)`);
+      const firedAtTurn = runtime.turnIndex;
+      const firedSessionId = turnSessionId;
+      const testRunGeneration = (priorTestCache?.testRunGeneration ?? 0) + 1;
+      const provenanceFiles = [
+        ...candidates.map((candidate) => ({
+          path: candidate.abs,
+          role: "source"
+        })),
+        ...targets.map((target) => ({
+          path: target.testFile,
+          role: "test"
+        }))
+      ];
+      const launchedFrom = snapshotAdvisoryProvenance({
+        cwd,
+        runtime,
+        generation: testRunGeneration,
+        files: provenanceFiles
+      });
+      writeTestFindings({
+        ...priorTestCache ?? { content: "" },
+        testRunGeneration
+      }, []);
+      runTestTargetsBounded({
+        targets,
+        concurrency: TEST_RUNNER_BATCH_CONCURRENCY,
+        budgetMs: TEST_RUNNER_BATCH_BUDGET_MS,
+        signal: getAmbientAbortSignal(),
+        run: (t, batchSignal) => testRunnerClient.runTestFileAsync(t.testFile, cwd, {
+          runner: t.runner,
+          config: t.config,
+          turnIndex: firedAtTurn,
+          signal: batchSignal
+        })
+      }).then(({ results, deferred, stopReason }) => {
+        const deferredTargets = deferred.map((t) => ({
+          testFile: t.testFile,
+          runner: t.runner,
+          attempts: (t.deferralAttempts ?? 0) + 1,
+          sessionId: firedSessionId
+        }));
+        if (deferred.length > 0) {
+          incrementDegradationCount({
+            kind: "test-runner-batch-capped",
+            subject: `${cwd}:${stopReason ?? "incomplete"}`,
+            reason: `test batch stopped early (${stopReason ?? "incomplete"}); ${deferred.length} target(s) killed or never dispatched, deferred to the next turn`
+          });
+          dbg(`turn_end: test batch stopped early (${stopReason ?? "incomplete"}), ${deferred.length} target(s) deferred to the next turn`);
+        }
+        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path.relative(cwd, t.testFile)).join(", ")}` : "";
+        const supersededByNewerGeneration = (label) => {
+          const current = cacheManager.readCache("test-runner-findings", cwd)?.data;
+          const currentGeneration = current?.testRunGeneration;
+          if (currentGeneration !== undefined && currentGeneration > testRunGeneration) {
+            dbg(`turn_end: ${label}test generation ${testRunGeneration} superseded by ${currentGeneration}`);
+            if (deferredTargets.length > 0) {
+              writeTestFindings({ ...current ?? { content: "" } }, deferredTargets);
+              dbg(`turn_end: ${label}carried ${deferredTargets.length} cut target(s) into the newer generation's deferral set`);
+            }
+            return true;
+          }
+          return false;
+        };
+        const publishedAgainst = snapshotAdvisoryProvenance({
+          cwd,
+          runtime,
+          generation: testRunGeneration,
+          files: provenanceFiles
+        });
+        const superseded = launchedFrom.revision.sessionId !== publishedAgainst.revision.sessionId || launchedFrom.revision.projectSeq !== publishedAgainst.revision.projectSeq || launchedFrom.revision.turnIndex !== publishedAgainst.revision.turnIndex || launchedFrom.files.some((file, index) => publishedAgainst.files[index]?.sha256 !== file.sha256 || publishedAgainst.files[index]?.path !== file.path);
+        const stale = runtime.turnIndex !== firedAtTurn;
+        const failures = [];
+        const resultValues = [];
+        let rejectedCount = 0;
+        let hasRealFailure = false;
+        for (const r of results) {
+          if (r.status === "rejected") {
+            rejectedCount++;
+            emitBounded("test_runner_delivery", `${cwd}:generation:${testRunGeneration}:rejected`, {
+              filePath: cwd,
+              durationMs: 0,
+              metadata: {
+                outcome: "runner-promise-rejected",
+                sessionId: firedSessionId,
+                generation: testRunGeneration,
+                targetCount: targets.length,
+                droppedDetailCount: 0,
+                reason: String(r.reason).slice(0, 500)
+              }
+            }, {
+              ledgerKind: "test-runner-delivery",
+              reason: "test runner promise rejected",
+              capPerTurn: { limit: 8, turnIndex: firedAtTurn }
+            });
+            dbg(`turn_end: test run rejected — ${r.reason}`);
+            continue;
+          }
+          resultValues.push(r.value);
+          const { file, runner, passed, failed, duration, error } = r.value;
+          if (failed > 0)
+            hasRealFailure = true;
+          const shortFile = path.basename(file);
+          const elapsed = formatRunDurationMs(duration);
+          const verdict = failed > 0 ? "FAIL" : "PASS";
+          const summary = error && passed === 0 && failed === 0 ? `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
+          dbg(`turn_end: ${stale ? "[stale] " : ""}test ${runner} ${shortFile} → ${summary}`);
+          if (failed > 0 || error) {
+            if (error && String(r.value?.error ?? "").includes("Test file not found")) {
+              continue;
+            }
+            const formatted = testRunnerClient.formatResult(r.value);
+            if (formatted)
+              failures.push(formatted);
+          }
+        }
+        if (rejectedCount > 0) {
+          failures.push(`Test runner rejected ${rejectedCount} promise(s) before producing a structured result.`);
+        }
+        if (failures.length > 0) {
+          if (supersededByNewerGeneration(""))
+            return;
+          const content = [
+            stale ? "[from a prior turn — the edit that triggered this run had already been superseded by the time results came back]" : "",
+            failures.join(`
+
+`),
+            deferralNote
+          ].filter(Boolean).join(`
+
+`);
+          const runnerErrorOnly = !hasRealFailure;
+          writeTestFindings({
+            content,
+            stale,
+            results: resultValues,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded,
+            runnerErrorOnly
+          }, deferredTargets);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: true
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+            const cleanFiles = resultValues.filter((value) => value.failed === 0 && !value.error).map((value) => value.file);
+            if (cleanFiles.length > 0) {
+              clearGitGuardTestFailure(cacheManager, cwd, runtime, cleanFiles);
+            }
+            mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues.filter((value) => value.failed > 0).map((value) => value.file));
+          }
+          dbg(`turn_end: ${failures.length} test failure(s) cached for pull diagnostics and post-agent delivery${stale ? " (stale — turn advanced while tests ran)" : ""}`);
+        } else if (deferred.length > 0) {
+          if (supersededByNewerGeneration("deferred "))
+            return;
+          writeTestFindings({
+            content: deferralNote,
+            stale,
+            results: resultValues,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded,
+            runnerErrorOnly: true
+          }, deferredTargets);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: true
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          dbg(`turn_end: partial test batch — ${results.length} target(s) settled, ${deferred.length} deferred to the next turn; NOT recorded as a clean run`);
+        } else if (results.length > 0) {
+          if (supersededByNewerGeneration("clean "))
+            return;
+          writeTestFindings({
+            ...priorTestCache ?? { content: "" },
+            content: "",
+            stale: false,
+            results: resultValues,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded
+          }, []);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: false
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+            clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues.map((value) => value.file));
+          }
+          dbg(`turn_end: all tests passed${stale ? " (stale — turn advanced while tests ran)" : ""}`);
+        }
+      }).catch(() => {});
+    } else if (carriedDeferred.length > 0) {
+      writeTestFindings({ ...priorTestCache ?? { content: "" } }, []);
+    }
+  }
+  if (runtime.errorDebtBaseline && files.length > 0) {
+    dbg("turn_end: marking error debt check for next session");
+    cacheManager.writeCache("errorDebt", {
+      pendingCheck: true,
+      baselineTestsPassed: runtime.errorDebtBaseline.testsPassed
+    }, cwd);
+  }
+  if (runtime.callGraph && files.length > 0) {
+    const coverage = runtime.callGraph.coverage;
+    if (!coverage || coverage.complete !== true) {
+      advisoryParts.push("Call-graph impact was not emitted because call-graph extraction coverage is incomplete; " + "the affected files may have unreported callers.");
+    } else {
+      try {
+        const { impact, formatImpact, parseSymbolKey } = await import("./call-graph.js");
+        const { callGraphImpactToProjectDiagnostics } = await import("./project-diagnostics/runner-adapters/call-graph-impact.js");
+        const impactLines = [];
+        const impactFindings = [];
+        for (const filePath of files.slice(0, 5)) {
+          const changedFileKey = normalizeMapKey(resolveRunnerPath(cwd, filePath));
+          const fileCallerKeys = [...runtime.callGraph.callers.keys()].filter((k) => {
+            const graphFilePath = parseSymbolKey(k).filePath;
+            return normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) === changedFileKey;
+          });
+          for (const calleeKey of fileCallerKeys.slice(0, 3)) {
+            const results = impact(runtime.callGraph, calleeKey).filter((r) => {
+              const callerFile = parseSymbolKey(r.symbolKey).filePath;
+              return !callerFile || !isTestRoleCollateral(resolveRunnerPath(cwd, callerFile));
+            });
+            if (results.length > 0) {
+              impactFindings.push({ calleeKey, results });
+              const summary = formatImpact(results, cwd);
+              if (summary)
+                impactLines.push(`  ${parseSymbolKey(calleeKey).symbolName ?? calleeKey}: ${summary}`);
+            }
+          }
+        }
+        if (impactLines.length > 0) {
+          advisoryParts.push(`\uD83D\uDCCA Call-graph impact (changed symbols have callers):
+${impactLines.join(`
+`)}`);
+        }
+        if (impactFindings.length > 0) {
+          const impactDiagnostics = callGraphImpactToProjectDiagnostics(cwd, impactFindings);
+          if (impactDiagnostics.length > 0) {
+            projectDiagnosticsDelta.push(...impactDiagnostics);
+            projectDiagnosticsSources.add("call-graph");
+          }
+        }
+      } catch {}
+    }
+  }
+  if (projectDiagnosticsDelta.length > 0) {
+    writeProjectDiagnosticsDeltaReport(cwd, {
+      version: PROJECT_DIAGNOSTICS_CACHE_VERSION,
+      cwd,
+      generatedAt: new Date().toISOString(),
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq,
+      diagnostics: projectDiagnosticsDelta,
+      sources: [...projectDiagnosticsSources].sort((a, b) => a.localeCompare(b))
+    });
+  }
+  const t4 = Date.now();
+  const modifiedRangesByFile = new Map(Object.entries(turnState.files).map(([file, state]) => [
+    normalizeMapKey(resolveRunnerPath(cwd, file)),
+    state.modifiedRanges
+  ]));
+  const getFileSeq = runtime.getFileSeq;
+  const fileSeqByPath = new Map;
+  if (getFileSeq) {
+    for (const file of files) {
+      const filePath = normalizeMapKey(resolveRunnerPath(cwd, file));
+      fileSeqByPath.set(filePath, getFileSeq.call(runtime, filePath));
+    }
+  }
+  if (getFlag("lens-actionable-warnings")) {
+    try {
+      const report = await buildActionableWarningsReport({
+        cwd,
+        sessionId: runtime.telemetrySessionId,
+        turnIndex: runtime.turnIndex,
+        files,
+        modifiedRangesByFile,
+        dispatchWarnings: runtime.peekActionableWarnings().filter((w) => !(isSecretWarning(w) && typeof w.line === "number" && secretBlockedLocations.has(secretLocationKey(w.filePath, w.line)))),
+        includeLspCodeActions: !!getFlag("lens-actionable-warning-actions"),
+        projectSeqStart: runtime.turnStartProjectSeq,
+        projectSeqEnd: runtime.projectSeq,
+        fileSeqByPath,
+        deltaOnly: !getFlag("lens-actionable-warning-all"),
+        dbg,
+        signal: getAmbientAbortSignal(),
+        onDeferredReport: (deferred) => {
+          try {
+            writeDeferredActionableWarningsReport({
+              cacheManager,
+              cwd,
+              report: deferred,
+              getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime, filePath) : undefined,
+              dbg
+            });
+          } catch (deferErr) {
+            dbg(`turn_end: deferred actionable-warnings write failed — ${deferErr}`);
+          }
+        }
+      });
+      const publishResult = publishActionableWarningsReport(cacheManager, cwd, report, {
+        origin: "in-band",
+        getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime, filePath) : undefined,
+        dbg
+      });
+      const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd);
+      if (advisory)
+        advisoryParts.push(advisory);
+      logActionableWarningsEvent({
+        event: advisory ? "advisory_injected" : "advisory_skipped",
+        sessionId: runtime.telemetrySessionId,
+        metadata: {
+          turnIndex: runtime.turnIndex,
+          unsuppressed: publishResult.report.summary.unsuppressed
+        }
+      });
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "actionable_warnings_report",
+        durationMs: Date.now() - t4,
+        metadata: report.summary
+      });
+    } catch (err) {
+      dbg(`turn_end: actionable warning report failed: ${err}`);
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "actionable_warnings_report",
+        durationMs: Date.now() - t4,
+        metadata: {
+          failed: true,
+          error: err instanceof Error ? err.message : String(err)
+        }
+      });
+    }
+  }
+  const t5 = Date.now();
+  try {
+    const qualityReport = buildCodeQualityWarningsReport({
+      cwd,
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      warnings: runtime.peekCodeQualityWarnings(),
+      modifiedRangesByFile,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq,
+      fileSeqByPath
+    });
+    writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
+    appendCodeQualityWarningsHistory(cwd, qualityReport);
+    const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd);
+    if (advisory)
+      advisoryParts.push(advisory);
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "code_quality_warnings_report",
+      durationMs: Date.now() - t5,
+      metadata: qualityReport.summary
+    });
+  } catch (err) {
+    dbg(`turn_end: code quality warning report failed: ${err}`);
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "code_quality_warnings_report",
+      durationMs: Date.now() - t5,
+      metadata: {
+        failed: true,
+        error: err instanceof Error ? err.message : String(err)
+      }
+    });
+  }
+  cacheManager.incrementTurnCycle(cwd, currentOwner);
+  const runnerFindingsStart = Date.now();
+  const pendingRunnerFindings = await drainPendingRunnerFindings(0);
+  let runnerFindingsDelivered = 0;
+  let runnerFindingsStale = 0;
+  let runnerFindingsFailed = 0;
+  let runnerFindingsDropped = 0;
+  const runnerFindingsDeliveredIds = [];
+  for (const pending of pendingRunnerFindings) {
+    const result = pending.result;
+    if (!result)
+      continue;
+    recordRunner(pending.filePath, pending.runnerId, result.status, result.diagnostics.length, Date.now() - pending.markedAtMs, pending.writeIndex);
+    if (result.status === "failed") {
+      runnerFindingsFailed += 1;
+      const detail = result.failureMessage ? `: ${result.failureMessage}` : "";
+      advisoryParts.push(`❌ Deferred runner ${pending.runnerId} failed (${result.failureKind ?? "unknown"})${detail}`);
+      continue;
+    }
+    const findings = result.diagnostics;
+    if (findings.length === 0)
+      continue;
+    const gate = gateFindingsByPathFreshness({
+      store: "late-runner-findings",
+      findings,
+      cwd,
+      scannedAt: pending.markedAtMs,
+      citedPath: (finding) => finding.filePath
+    });
+    runnerFindingsStale += gate.stale.length;
+    if (gate.stale.length > 0) {
+      dropStaleRunnerFindings(pending);
+      runnerFindingsDropped += 1;
+    }
+    if (gate.live.length === 0)
+      continue;
+    const displayPath = toRunnerDisplayPath(cwd, pending.filePath);
+    const lines = gate.live.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
+    runnerFindingsDelivered += gate.live.length;
+    for (const finding of gate.live) {
+      if (runnerFindingsDeliveredIds.length < 50) {
+        runnerFindingsDeliveredIds.push(finding.id);
+      }
+    }
+    advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit):
+${lines.join(`
+`)}`);
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "late_runner_findings",
+    durationMs: Date.now() - runnerFindingsStart,
+    metadata: {
+      pending: pendingRunnerFindings.length,
+      delivered: runnerFindingsDelivered,
+      stale: runnerFindingsStale,
+      failed: runnerFindingsFailed,
+      dropped: runnerFindingsDropped,
+      deliveredIds: runnerFindingsDeliveredIds
+    }
+  });
+  const lateAuxStart = Date.now();
+  const drainedPairs = drainPendingAuxiliaryCoverage();
+  const lateAuxCapEvicted = drainPendingAuxCapEvictedCount();
+  let lateAuxDelivered = 0;
+  let lateAuxStale = 0;
+  let lateAuxMissing = 0;
+  let lateAuxRearmed = 0;
+  let lateAuxClientGone = 0;
+  let lateAuxProbeFailed = 0;
+  let lateAuxCleanConfirmed = 0;
+  let lateAuxExpired = 0;
+  let lateAuxCeilingExhausted = 0;
+  let lateAuxAnswered = 0;
+  let lateAuxNotifyStallDemoted = 0;
+  const lateAuxCoverageGapPairs = [];
+  let lateAuxCoverageGapDetailCount = 0;
+  let lateAuxCoverageGapDropCount = 0;
+  const lateAuxStuckPairs = [];
+  if (drainedPairs.length > 0) {
+    const byFile = new Map;
+    for (const pair of drainedPairs) {
+      const list = byFile.get(pair.filePath);
+      if (list)
+        list.push(pair);
+      else
+        byFile.set(pair.filePath, [pair]);
+    }
+    try {
+      const service = getLSPService();
+      for (const [lateAuxPath, pairs] of byFile) {
+        let cached;
+        try {
+          cached = await service.readCachedDiagnosticsForServers(lateAuxPath, new Set(pairs.map((p) => p.serverId)));
+        } catch {
+          lateAuxProbeFailed += pairs.length;
+          for (const pair of pairs) {
+            if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+            } else if (isPendingAuxiliaryPastRearmTtl(pair)) {
+              lateAuxExpired += 1;
+            } else {
+              lateAuxCeilingExhausted += 1;
+            }
+          }
+          continue;
+        }
+        const displayLateAuxPath = toRunnerDisplayPath(cwd, lateAuxPath);
+        for (const pair of pairs) {
+          const cachedEntry = cached.get(pair.serverId);
+          if (cachedEntry === undefined) {
+            lateAuxClientGone += 1;
+            continue;
+          }
+          if (cachedEntry.notifyStallDemoted) {
+            if (cachedEntry.demotedAt === undefined || pair.markedAtMs > cachedEntry.demotedAt) {
+              lateAuxClientGone += 1;
+              continue;
+            }
+            lateAuxNotifyStallDemoted += 1;
+            const pastTtl = isPendingAuxiliaryPastRearmTtl(pair);
+            const atCeiling = (pair.rearmCount ?? 0) >= MAX_LATE_AUX_REARMS;
+            if (!pastTtl && !atCeiling) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+              if (lateAuxStuckPairs.length < 20)
+                lateAuxStuckPairs.push({
+                  filePath: pair.filePath,
+                  serverId: pair.serverId
+                });
+            } else {
+              if (pastTtl)
+                lateAuxExpired += 1;
+              else
+                lateAuxCeilingExhausted += 1;
+              lateAuxCoverageGapPairs.push({
+                filePath: pair.filePath,
+                serverId: pair.serverId
+              });
+            }
+            continue;
+          }
+          const rawDiags = cachedEntry.diags;
+          if (cachedEntry.publishedAt === undefined || cachedEntry.publishedAt <= pair.markedAtMs) {
+            if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+              if (lateAuxStuckPairs.length < 20)
+                lateAuxStuckPairs.push({
+                  filePath: pair.filePath,
+                  serverId: pair.serverId
+                });
+            } else {
+              if (isPendingAuxiliaryPastRearmTtl(pair))
+                lateAuxExpired += 1;
+              else
+                lateAuxCeilingExhausted += 1;
+            }
+            continue;
+          }
+          if (rawDiags.length === 0) {
+            lateAuxCleanConfirmed += 1;
+            continue;
+          }
+          const converted = convertLspDiagnostics(rawDiags, lateAuxPath, {
+            tool: "lsp"
+          });
+          if (converted.length === 0) {
+            lateAuxMissing += rawDiags.length;
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const gate = gateFindingsByPathFreshness({
+            store: "late-auxiliary-findings",
+            findings: converted,
+            cwd,
+            scannedAt: pair.markedAtMs,
+            citedPath: () => lateAuxPath
+          });
+          lateAuxStale += gate.stale.length;
+          lateAuxMissing += converted.length - gate.live.length - gate.stale.length;
+          if (gate.live.length === 0) {
+            if (gate.stale.length > 0) {
+              if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+                rearmPendingAuxiliaryCoverage(pair, Date.now(), true);
+                lateAuxRearmed += 1;
+              } else if (isPendingAuxiliaryPastRearmTtl(pair)) {
+                lateAuxExpired += 1;
+              } else {
+                lateAuxCeilingExhausted += 1;
+              }
+            } else {
+              lateAuxAnswered += 1;
+            }
+            continue;
+          }
+          const lines = gate.live.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
+          lateAuxDelivered += gate.live.length;
+          lateAuxAnswered += 1;
+          advisoryParts.push(`\uD83D\uDD50 Late auxiliary diagnostics (${pair.serverId} answered after its grace window):
+${lines.join(`
+`)}`);
+        }
+      }
+    } catch (err) {
+      dbg(`turn_end: late-auxiliary probe failed: ${err}`);
+    }
+    for (const pair of lateAuxCoverageGapPairs) {
+      const normalizedPairPath = normalizeMapKey(pair.filePath);
+      const emitted = emitBounded("lsp_scanner_coverage_gap", `${pair.serverId}:${normalizedPairPath}`, {
+        filePath: normalizedPairPath,
+        durationMs: 0,
+        metadata: {
+          source: "late-auxiliary",
+          serverIds: [pair.serverId],
+          reason: "notify-stall-replacement-unavailable",
+          reRaised: true
+        }
+      }, {
+        ledgerKind: "lsp-scanner-coverage-gap",
+        reason: "notify-stall replacement was not available before late-coverage ceiling",
+        capPerTurn: {
+          limit: LATE_AUX_COVERAGE_GAP_DETAIL_CAP_PER_TURN,
+          turnIndex: runtime.turnIndex
+        }
+      });
+      if (emitted)
+        lateAuxCoverageGapDetailCount += 1;
+      else
+        lateAuxCoverageGapDropCount += 1;
+    }
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "late_auxiliary_findings",
+      durationMs: Date.now() - lateAuxStart,
+      metadata: {
+        pending: drainedPairs.length,
+        pairCreated: drainedPairs.length + lateAuxCapEvicted,
+        pendingAfter: pendingAuxiliaryCoverageSize(),
+        delivered: lateAuxDelivered,
+        stale: lateAuxStale,
+        missing: lateAuxMissing,
+        rearmed: lateAuxRearmed,
+        clientGone: lateAuxClientGone,
+        probeFailed: lateAuxProbeFailed,
+        cleanConfirmed: lateAuxCleanConfirmed,
+        expired: lateAuxExpired,
+        ceilingExhausted: lateAuxCeilingExhausted,
+        answered: lateAuxAnswered,
+        notifyStallDemoted: lateAuxNotifyStallDemoted,
+        coverageGapReRaised: lateAuxCoverageGapPairs.length,
+        coverageGapReRaisedDetailed: lateAuxCoverageGapDetailCount,
+        coverageGapReRaisedDropped: lateAuxCoverageGapDropCount,
+        capEvicted: lateAuxCapEvicted,
+        stuckPairs: lateAuxStuckPairs
+      }
+    });
+  }
+  const labeledAdvisoryParts = advisoryParts.map((p) => `ℹ️ Advisory — no action required this turn:
+${p}`);
+  const findingParts = [
+    ...blockerParts,
+    ...staleSecretParts,
+    ...labeledAdvisoryParts
+  ];
+  if (findingParts.length > 0) {
+    dbg(`turn_end: ${blockerParts.length} blocker section(s), ${advisoryParts.length} advisory section(s) found, persisting for next context`);
+    const content = capTurnEndMessage(findingParts.join(`
+
+`));
+    const signature = `${files.slice().sort((a, b) => compareOrdinal(a, b)).join("|")}::${content}`;
+    const last = cacheManager.readCache("turn-end-findings-last", cwd);
+    if (last?.data?.signature === signature && last?.data?.sessionId === runtime.telemetrySessionId) {
+      dbg("turn_end: duplicate findings detected (same session), suppressing re-prompt");
+      if (getFlag("lens-guard")) {
+        const existingGuard = cacheManager.readCache("turn-end-findings", cwd)?.data;
+        if (existingGuard) {
+          writeGitGuardRecord(cacheManager, runtime, cwd, {
+            ...existingGuard,
+            content,
+            blockerContent: blockerParts.length > 0 ? capTurnEndMessage(blockerParts.join(`
+
+`)) : undefined,
+            hasBlockers: blockerParts.length > 0 || existingGuard.testFailures === true,
+            blockingFiles: blockerParts.length > 0 ? existingGuard.affectedFiles : undefined,
+            projectSeqStart: runtime.turnStartProjectSeq,
+            projectSeqEnd: runtime.projectSeq,
+            fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [
+              normalizeMapKey(path.resolve(filePath)),
+              seq
+            ])),
+            fileContentHashes: {},
+            consumed: false
+          });
+        }
+      }
+      cacheManager.clearTurnState(cwd, currentOwner);
+      runtime.fixedThisTurn.clear();
+      resetFormatService();
+      return;
+    }
+    for (const commit of pendingDependencyDriftDeliveries)
+      commit();
+    const fileSeqByPath = {};
+    for (const [filePath, seq] of runtime.getFileSeqEntries()) {
+      fileSeqByPath[normalizeMapKey(path.resolve(filePath))] = seq;
+    }
+    if (getFlag("lens-guard")) {
+      const existingGuard = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      const blockingContent = blockerParts.length > 0 ? capTurnEndMessage(blockerParts.join(`
+
+`)) : undefined;
+      const affectedFiles = [
+        ...existingGuard?.affectedFiles ?? [],
+        ...files.map((file) => resolveRunnerPath(cwd, file)),
+        ...cascadeResults.flatMap((result) => result.neighbors.filter((neighbor) => neighbor.diagnostics.length > 0).map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath)))
+      ];
+      writeGitGuardRecord(cacheManager, runtime, cwd, {
+        content: [content, existingGuard?.testFailureContent].filter((value) => !!value).join(`
+
+`),
+        blockerContent: blockingContent,
+        blockingFiles: blockerParts.length > 0 ? affectedFiles : undefined,
+        hasBlockers: !!blockingContent || existingGuard?.testFailures === true,
+        affectedFiles,
+        sessionId: runtime.telemetrySessionId,
+        projectSeqStart: runtime.turnStartProjectSeq,
+        projectSeqEnd: runtime.projectSeq,
+        fileSeqByPath,
+        fileContentHashes: {},
+        consumed: false,
+        testFailures: existingGuard?.testFailures,
+        testFailureContent: existingGuard?.testFailureContent,
+        testFailureFiles: existingGuard?.testFailureFiles
+      });
+    } else {
+      const allAffectedFiles = [
+        ...files.map((file) => resolveRunnerPath(cwd, file)),
+        ...cascadeResults.flatMap((result) => result.neighbors.filter((neighbor) => neighbor.diagnostics.length > 0).map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath)))
+      ];
+      const affectedFiles = [...new Set(allAffectedFiles)].slice(0, MAX_ADVISORY_AFFECTED_FILES);
+      const affectedFilesTruncated = new Set(allAffectedFiles).size > affectedFiles.length;
+      cacheManager.writeCache("turn-end-findings", {
+        content,
+        affectedFiles,
+        affectedFilesTruncated,
+        provenance: snapshotAdvisoryProvenance({
+          cwd,
+          runtime,
+          generation: 0,
+          files: affectedFiles.map((file) => ({
+            path: file,
+            role: "affected"
+          })),
+          truncated: affectedFilesTruncated
+        })
+      }, cwd);
+    }
+    cacheManager.writeCache("turn-end-findings-last", {
+      signature,
+      sessionId: runtime.telemetrySessionId,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq
+    }, cwd);
+    emitLensTurnFindings({
+      cwd,
+      filePaths: files.map((file) => resolveRunnerPath(cwd, file)),
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      blockerSections: blockerParts.length,
+      advisorySections: advisoryParts.length,
+      content
+    });
+  }
+  if (blockerParts.length === 0) {
+    cacheManager.clearTurnState(cwd, currentOwner);
+    if (getFlag("lens-guard") && advisoryParts.length === 0 && staleSecretParts.length === 0 && !runtime.gitGuardHasBlockers) {
+      const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
+        cacheManager.clearCache("turn-end-findings", cwd);
+      }
+    }
+  }
+  runtime.fixedThisTurn.clear();
+  runtime.clearActionableWarnings();
+  runtime.clearCodeQualityWarnings();
+  if (demotedFindingsRetired > 0) {
+    cacheManager.clearCache("turn-end-findings-last", cwd);
+  }
+  logLatency({
+    type: "tool_result",
+    toolName: "turn_end",
+    filePath: cwd,
+    durationMs: Date.now() - turnEndStart,
+    result: blockerParts.length > 0 ? "blockers_found" : staleSecretParts.length > 0 ? "stale_secrets_pending" : "clean",
+    metadata: {
+      fileCount: files.length,
+      blockerSections: blockerParts.length,
+      staleSecretSections: staleSecretParts.length,
+      advisorySections: advisoryParts.length,
+      demotedFindingsRetired,
+      widgetDemotedFindingsRetired
+    }
+  });
+  resetFormatService();
+}