@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/clients/effective-config.js

@@ -24,7 +24,9 @@ import {
 } from "./lsp/config.js";
 import { isSameOrWithin } from "./lsp/server.js";
 import { homeRelativePath } from "./path-utils.js";
+import { resolveToolCwd } from "./tool-cwd.js";
 import { compareOrdinal } from "./string-utils.js";
+import { LENS_TOOL_NAMES, resolveLensToolEnabled } from "./tool-config.js";
 export function isEffectiveFileViewError(file) {
   return "error" in file;
 }
@@ -83,7 +85,7 @@ export async function effectiveConfig(options = {}) {
   const resolveAt = (dir) => resolveDmLensConfig({
     cwd: dir,
     globalDir: getGlobalDmLensDir(),
-    globalConfigPath: getDmLensGlobalConfigPath(homeDir),
+    globalConfigPath: getDmLensGlobalConfigPath(),
     homeDir
   });
   const requestedFile = options.file === undefined ? undefined : path.resolve(cwd, options.file);
@@ -102,12 +104,16 @@ export async function effectiveConfig(options = {}) {
     provenance: provenanceView(resolved, homeDir).entries,
     provenanceCounts: summary.countsByTier,
     recordCounts: countBy(resolution.records, (record) => record.code),
+    tools: LENS_TOOL_NAMES.map((name) => ({
+      name,
+      enabled: resolveLensToolEnabled(name, resolved.value, undefined, options.noTools)
+    })),
     ...fileOutsideCwd ? {
       file: {
         error: `file is outside cwd (${homeRelativeCwd}); query with cwd set ` + "to the file's own workspace instead"
       }
     } : absolute === undefined ? {} : {
-      file: await fileView(absolute, resolved, homeDir, registerLSPConfig(lspConfigOf(resolution.value)))
+      file: await fileView(absolute, resolved, homeDir, cwd, registerLSPConfig(lspConfigOf(resolution.value)))
     }
   };
   return view;
@@ -117,7 +123,7 @@ function toolReason(selected, kind) {
     return "selected";
   return kind === undefined ? "no-dispatch-plan" : "not-registered-for-kind";
 }
-async function fileView(absolute, resolved, homeDir, lspConfig) {
+async function fileView(absolute, resolved, homeDir, workspaceCwd, lspConfig) {
   const language = resolveLanguage(absolute);
   const kind = detectFileKind(absolute);
   const section = lspSectionOf(resolved.value);
@@ -150,7 +156,11 @@ async function fileView(absolute, resolved, homeDir, lspConfig) {
   const tools = ids.map((id) => ({
     id,
     selected: available.has(id),
-    reason: toolReason(available.has(id), kind)
+    reason: toolReason(available.has(id), kind),
+    resolvedCwd: homeRelativePath(resolveToolCwd("runner", id, absolute, {
+      cwd: workspaceCwd,
+      suppressTelemetry: true
+    }).cwd, homeDir)
   }));
   return {
     path: homeRelativePath(absolute, homeDir),

package/extensions/dm-lens/clients/event-loop-hold.js

@@ -0,0 +1,123 @@
+import {
+  claimPhaseOncePerSession,
+  logLatency,
+  releaseOncePerSessionPhase
+} from "./latency-logger.js";
+import { getWorkspaceSweepMaxHoldAgeMs } from "./lsp/workspace-sweep-hold.js";
+import { getProcessSingleton } from "./process-singletons.js";
+const EVENT_LOOP_HOLD_ARMED_PHASE = "event_loop_hold_armed";
+const EVENT_LOOP_HOLD_FAMILY = "event-loop-hold";
+const EVENT_LOOP_HOLD_VERSION = 1;
+function state() {
+  return getProcessSingleton(EVENT_LOOP_HOLD_FAMILY, EVENT_LOOP_HOLD_VERSION, () => ({ holds: new Map, nextHoldId: 1, timer: undefined }));
+}
+export function getEventLoopHoldMaxMs() {
+  return getWorkspaceSweepMaxHoldAgeMs();
+}
+function armForNextDeadline(current) {
+  if (current.timer !== undefined)
+    return;
+  if (current.holds.size === 0)
+    return;
+  const maxMs = getEventLoopHoldMaxMs();
+  let soonest = Number.POSITIVE_INFINITY;
+  for (const entry of current.holds.values()) {
+    soonest = Math.min(soonest, entry.acquiredAt + maxMs);
+  }
+  const delayMs = soonest - Date.now();
+  current.timer = setTimeout(() => reapStaleHolds(), delayMs);
+}
+function disarmIfIdle(current) {
+  if (current.holds.size > 0)
+    return;
+  if (current.timer === undefined)
+    return;
+  clearTimeout(current.timer);
+  current.timer = undefined;
+}
+function reapStaleHolds() {
+  const current = state();
+  current.timer = undefined;
+  try {
+    const maxMs = getEventLoopHoldMaxMs();
+    const now = Date.now();
+    const released = [];
+    for (const [holdId, entry] of current.holds) {
+      if (now - entry.acquiredAt <= maxMs)
+        continue;
+      current.holds.delete(holdId);
+      released.push(entry);
+    }
+    if (released.length > 0) {
+      recordForceReleased(released, current.holds.size, maxMs, now);
+    }
+  } finally {
+    armForNextDeadline(current);
+  }
+}
+function recordForceReleased(released, stillHeld, maxMs, now) {
+  try {
+    const oldestAcquiredAt = Math.min(...released.map((entry) => entry.acquiredAt));
+    logLatency({
+      type: "phase",
+      phase: "event_loop_hold_force_released",
+      filePath: "",
+      durationMs: now - oldestAcquiredAt,
+      metadata: {
+        maxHoldMs: maxMs,
+        releasedHolds: released.length,
+        stillHeld,
+        labels: [...new Set(released.map((entry) => entry.label))].slice(0, 8)
+      }
+    });
+  } catch {}
+}
+function recordFirstArm(entry, maxMs) {
+  try {
+    if (!claimPhaseOncePerSession(EVENT_LOOP_HOLD_ARMED_PHASE, "process")) {
+      return;
+    }
+    logLatency({
+      type: "phase",
+      phase: EVENT_LOOP_HOLD_ARMED_PHASE,
+      filePath: "",
+      durationMs: 0,
+      metadata: { label: entry.label, maxHoldMs: maxMs }
+    });
+  } catch {}
+}
+export function acquireEventLoopHold(label) {
+  const current = state();
+  const holdId = current.nextHoldId++;
+  const entry = { acquiredAt: Date.now(), label };
+  current.holds.set(holdId, entry);
+  const wasArmed = current.timer !== undefined;
+  armForNextDeadline(current);
+  if (!wasArmed)
+    recordFirstArm(entry, getEventLoopHoldMaxMs());
+  return () => {
+    const now = state();
+    if (!now.holds.delete(holdId))
+      return;
+    disarmIfIdle(now);
+  };
+}
+export function _eventLoopHoldCountForTests() {
+  return state().holds.size;
+}
+export function _eventLoopKeepAliveForTests() {
+  const timer = state().timer;
+  return {
+    armed: timer !== undefined,
+    hasRef: timer?.hasRef?.() === true
+  };
+}
+export function _resetEventLoopHoldForTests() {
+  releaseOncePerSessionPhase(EVENT_LOOP_HOLD_ARMED_PHASE);
+  const current = state();
+  current.holds.clear();
+  if (current.timer !== undefined)
+    clearTimeout(current.timer);
+  current.timer = undefined;
+  current.nextHoldId = 1;
+}

package/extensions/dm-lens/clients/event-loop-monitor.js

@@ -27,8 +27,8 @@ export function startEventLoopMonitor(resolutionMs = 20) {
     });
   }
 }
-export const STALL_CLASSIFY_FLOOR_MS = 1000;
-export const STALL_CLASSIFY_SLOP_MS = 250;
+const STALL_CLASSIFY_FLOOR_MS = 1000;
+const STALL_CLASSIFY_SLOP_MS = 250;
 export function classifyLoopBlock(maxMs, windowCpuMs, options = {}) {
   const {
     floorMs = STALL_CLASSIFY_FLOOR_MS,

package/extensions/dm-lens/clients/extension-log.js

@@ -4,6 +4,7 @@ import { isTestMode } from "./env-utils.js";
 import { getGlobalDmLensLogDir } from "./probe-home-state.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
+import { getTurnId } from "./turn-context.js";
 export const EXTENSION_LOG_FILE = path.join(getGlobalDmLensLogDir(), "extension.log");
 const writer = createNdjsonLogger({
   filePath: EXTENSION_LOG_FILE,
@@ -15,6 +16,7 @@ export function logExtension(entry) {
   writer.log({
     ts: new Date().toISOString(),
     pid: process.pid,
+    turnId: getTurnId(),
     level: entry.level ?? "error",
     subsystem: entry.subsystem,
     message: entry.message,
@@ -98,6 +100,9 @@ function inCaptureWindow(fn) {
 function isCaptureSeam(prop) {
   return prop === "on" || typeof prop === "string" && prop.startsWith("register");
 }
+function isCallableSchema(value) {
+  return typeof value === "function" && typeof value.toJsonSchema === "function" && typeof value.assert === "function";
+}
 function wrapFunctionsInPlace(value) {
   if (typeof value === "function") {
     return inCaptureWindow(value);
@@ -108,7 +113,7 @@ function wrapFunctionsInPlace(value) {
   const obj = value;
   for (const key of Object.keys(obj)) {
     const propValue = obj[key];
-    if (typeof propValue === "function") {
+    if (typeof propValue === "function" && !isCallableSchema(propValue)) {
       assignWrapped(obj, key, propValue);
     }
   }

package/extensions/dm-lens/clients/feature-hints.js

@@ -1,8 +1,9 @@
+import { escapeRegExp } from "./string-utils.js";
 function normalizeHintInput(value) {
   return value.replace(/\\/g, "/");
 }
 function hasHintToken(value, tokens) {
-  const escaped = tokens.map((token) => token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  const escaped = tokens.map((token) => escapeRegExp(token));
   const alternatives = escaped.join("|");
   return new RegExp(`(?:^|[/_.\\-\\s])(?:${alternatives})(?=[/_.\\-\\s]|$)`, "i").test(value) || new RegExp(`(?:^|(?<=[a-z0-9]))(?:${tokens.flatMap((token) => [
     token[0].toUpperCase() + token.slice(1),

package/extensions/dm-lens/clients/file-kinds.js

@@ -1,4 +1,7 @@
-import { basename, extname } from "node:path";
+import { basename, extname, win32 } from "node:path";
+import * as path from "node:path";
+import { isWindowsPath } from "./path-utils.js";
+import { findNearestDirWithMarker } from "./workspace-topology.js";
 export const KIND_EXTENSIONS = {
   clojure: [".clj", ".cljc", ".cljs", ".edn"],
   cmake: [".cmake"],
@@ -26,6 +29,7 @@ export const KIND_EXTENSIONS = {
     ".ixx",
     ".cu",
     ".hip",
+    ".cuh",
     ".m",
     ".mm",
     ".cl",
@@ -75,7 +79,7 @@ export const KIND_EXTENSIONS = {
   yaml: [".yaml", ".yml"],
   zig: [".zig", ".zon"]
 };
-export function hasKindExtension(filePath, kind) {
+function hasKindExtension(filePath, kind) {
   const extension = extname(filePath).toLowerCase();
   return KIND_EXTENSIONS[kind].some((candidate) => candidate === extension);
 }
@@ -128,10 +132,21 @@ export const SPECIAL_FILENAMES = [
     kind: "terragrunt"
   }))
 ];
+export function isHelmYamlTemplatePath(filePath) {
+  const templatesSegment = isWindowsPath(filePath) ? /[\\/]templates[\\/]/i : /\/templates\//i;
+  if (!templatesSegment.test(filePath) || !/\.ya?ml$/i.test(filePath)) {
+    return false;
+  }
+  const pathApi = isWindowsPath(filePath) ? win32 : path;
+  return Boolean(findNearestDirWithMarker(pathApi.dirname(filePath), "chartYamlPath"));
+}
 export function detectFileKind(filePath) {
   if (!filePath || typeof filePath !== "string") {
     return;
   }
+  if (isHelmYamlTemplatePath(filePath)) {
+    return "helm-template";
+  }
   const base = basename(filePath);
   for (const { pattern, kind } of SPECIAL_FILENAMES) {
     if (pattern.test(base)) {
@@ -197,12 +212,6 @@ export const NON_CODE_KINDS = new Set([
   "toml",
   "yaml"
 ]);
-export function isCodeKind(kind) {
-  return CODE_KINDS.has(kind);
-}
-export function isConfigKind(kind) {
-  return NON_CODE_KINDS.has(kind);
-}
 export function isCodeKindFile(filePath) {
   const kind = detectFileKind(filePath);
   return kind !== undefined && CODE_KINDS.has(kind);
@@ -250,19 +259,6 @@ export function getFileKindLabel(kind) {
   };
   return labels[kind] ?? kind;
 }
-export function getExtensionsForKind(kind) {
-  return [...KIND_EXTENSIONS[kind] ?? []];
-}
-export function isScannableFile(filePath) {
-  const kind = detectFileKind(filePath);
-  if (!kind)
-    return false;
-  const base = basename(filePath);
-  if (base.includes(".test.") || base.includes(".spec.") || base.startsWith("test-") || base.startsWith("spec-")) {
-    return false;
-  }
-  return isCodeKind(kind) || isConfigKind(kind);
-}
 export function getLanguageId(kind) {
   const languageIds = {
     jsts: "typescript",

package/extensions/dm-lens/clients/file-role.js

@@ -13,11 +13,20 @@ function isTypeStub(content) {
   const typeOnlyLines = lines.filter((l) => /^(export\s+)?(interface|type|abstract\s+class|declare\s+(class|function|const|var|let|module|namespace|enum))\s+/.test(l) || /^(import\s+type\s+|import\s+\{)/.test(l) || /^export\s+type\s+\{/.test(l));
   return typeOnlyLines.length / lines.length >= 0.75;
 }
+function testFileNameMatches(rawBase, base) {
+  return base.includes(".test.") || base.includes(".spec.") || base.includes("_test.") || base.includes("_spec.") || base.startsWith("test_") || base.startsWith("spec_") || /(Test|Tests|TestCase)\.(java|kt|kts|cs|fs|php)$/.test(rawBase);
+}
+export function isTestFileName(filePath) {
+  const windowsShaped = isWindowsPath(filePath);
+  const rawBase = windowsShaped ? win32.basename(filePath) : basename(filePath);
+  return testFileNameMatches(rawBase, rawBase.toLowerCase());
+}
 export function detectFileRole(filePath, content) {
   const windowsShaped = isWindowsPath(filePath);
-  const base = (windowsShaped ? win32.basename(filePath) : basename(filePath)).toLowerCase();
+  const rawBase = windowsShaped ? win32.basename(filePath) : basename(filePath);
+  const base = rawBase.toLowerCase();
   const dir = (windowsShaped ? win32.dirname(filePath) : dirname(filePath)).replace(/\\/g, "/").toLowerCase();
-  if (base.includes(".test.") || base.includes(".spec.") || base.startsWith("test_") || base.startsWith("spec_") || dir.includes("/__tests__/") || dir.includes("/test/") || dir.includes("/tests/") || dir.includes("/spec/") || dir.includes("/specs/") || /[/_-]tests?\/?$/.test(dir) || /[/_-]specs?\/?$/.test(dir))
+  if (testFileNameMatches(rawBase, base) || /(^|[\\/])__tests__([\\/]|$)/.test(dir) || dir.includes("/test/") || dir.includes("/tests/") || dir.includes("/spec/") || dir.includes("/specs/") || /[/_-]tests?\/?$/.test(dir) || /[/_-]specs?\/?$/.test(dir))
     return "test";
   if (isGeneratedOrArtifact(filePath, { content, includeDeclarations: false })) {
     return "generated";

package/extensions/dm-lens/clients/file-time.js

@@ -75,7 +75,7 @@ export class FileTime {
   }
 }
 
-export class FileTimeError extends Error {
+class FileTimeError extends Error {
   filePath;
   reason;
   constructor(message, filePath, reason) {

package/extensions/dm-lens/clients/file-utils.js

@@ -1,7 +1,9 @@
 import * as fs from "node:fs";
+import { createHash } from "node:crypto";
 import * as os from "node:os";
 import * as path from "node:path";
 import { Minimatch } from "./deps/minimatch.js";
+import { detectFileRole } from "./file-role.js";
 import { FRESHNESS_CADENCE_MS } from "./freshness-cadence.js";
 import {
   isInSpawnTimeoutCooldown,
@@ -37,9 +39,91 @@ export function getProjectDataDir(cwd) {
     return legacyProjectDir;
   }
   const base = configuredBase || path.join(getGlobalDmLensDir(), "projects");
-  const normalized = normalizeFilePath(path.resolve(cwd));
-  const slug = normalized.replace(/^[a-z]:/i, "").replace(/\/+/g, "-").replace(/[^A-Za-z0-9-]/g, "").replace(/^-+/, "").replace(/-+$/, "");
-  return path.join(base.trim(), slug || "default");
+  const resolvedBase = base.trim();
+  const memoKey = `${resolvedBase}\x00${path.resolve(cwd)}`;
+  const cached = settledDataDirs.get(memoKey);
+  if (cached !== undefined)
+    return cached;
+  const canonical = canonicalProjectRoot(cwd);
+  const readable = projectDataDirReadableSlug(canonical.root);
+  const hash = projectDataDirRootHash(canonical.root);
+  const slug = `${readable || "default"}-${hash}`;
+  const dir = path.join(resolvedBase, slug);
+  const settled = settleProjectDataDir(resolvedBase, readable || "default", dir, memoKey, canonical.fallback);
+  return settled;
+}
+function projectDataDirReadableSlug(canonicalRoot) {
+  const normalized = normalizeFilePath(canonicalRoot);
+  return normalized.replace(/^[a-z]:/i, "").replace(/\/+/g, "-").replace(/[^A-Za-z0-9-]/g, "").replace(/^-+/, "").replace(/-+$/, "");
+}
+function canonicalProjectRoot(cwd) {
+  const resolved = path.resolve(cwd);
+  try {
+    fs.realpathSync(resolved);
+  } catch {
+    return { root: resolved, fallback: true };
+  }
+  return { root: resolved, fallback: false };
+}
+function projectDataDirRootHash(canonicalRoot) {
+  return createHash("sha256").update(canonicalRoot).digest("hex").slice(0, 8);
+}
+const pendingDataDirMigrations = [];
+const settledDataDirs = new Map;
+export function resetProjectDataDirSessionState() {
+  pendingDataDirMigrations.splice(0);
+}
+function settleProjectDataDir(base, oldSlug, dir, memoKey, identityFallback) {
+  const oldDir = path.join(base, oldSlug);
+  const newExists = fs.existsSync(dir);
+  const oldExists = fs.existsSync(oldDir);
+  if (!oldExists) {
+    if (identityFallback && pendingDataDirMigrations.length < 32) {
+      pendingDataDirMigrations.push({
+        to: dir,
+        outcome: "identity-fallback"
+      });
+    }
+    settledDataDirs.set(memoKey, dir);
+    return dir;
+  }
+  if (!newExists) {
+    try {
+      fs.renameSync(oldDir, dir);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        if (fs.existsSync(dir)) {
+          settledDataDirs.set(memoKey, dir);
+          return dir;
+        }
+        if (fs.existsSync(oldDir))
+          return oldDir;
+        return dir;
+      }
+      if (pendingDataDirMigrations.length < 32) {
+        pendingDataDirMigrations.push({
+          to: dir,
+          outcome: "rename-failed"
+        });
+      }
+      settledDataDirs.set(memoKey, oldDir);
+      return oldDir;
+    }
+  }
+  settledDataDirs.set(memoKey, dir);
+  if (pendingDataDirMigrations.length < 32) {
+    pendingDataDirMigrations.push({
+      to: dir,
+      outcome: newExists ? "coexisting" : "renamed"
+    });
+  }
+  return dir;
+}
+export function drainProjectDataDirMigrations() {
+  return pendingDataDirMigrations.splice(0);
+}
+export function _resetProjectDataDirMemoForTests() {
+  settledDataDirs.clear();
 }
 export function displayProjectDataPath(cwd, ...segments) {
   const absolute = path.resolve(getProjectDataDir(cwd), ...segments);
@@ -74,6 +158,7 @@ export const EXCLUDED_DIRS = [
   ".next",
   ".dm-lens",
   ".pi",
+  ".omp",
   ".ruff_cache",
   ".worktrees",
   ".claude",
@@ -207,7 +292,7 @@ function matchesGitignorePattern(pattern, relativePath, isDirectory, matchExpand
     return candidates.some((value) => matchExpanded(value, expanded));
   });
 }
-export function readGitignorePatterns(rootDir, layer = "gitignore") {
+function readGitignorePatterns(rootDir, layer = "gitignore") {
   const gitignorePath = path.join(rootDir, ".gitignore");
   try {
     return parseGitignoreContent(fs.readFileSync(gitignorePath, "utf-8"), layer);
@@ -482,7 +567,7 @@ export function readGitignoreDirs(rootDir) {
   return readGitignorePatterns(rootDir).filter((entry) => !entry.negated && !entry.pattern.includes("*") && !entry.pattern.includes("?") && !entry.pattern.includes("[") && !entry.pattern.includes("/")).map((entry) => entry.pattern);
 }
 function globToRegExp(glob) {
-  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  const escaped = glob.replace(/\*+/g, "*").replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${escaped}$`, "i");
 }
 export function isExcludedDirName(dirName, extraPatterns = []) {
@@ -559,6 +644,8 @@ export async function detectFileChangedAfterCommand(filePath, command, args, cwd
   }
 }
 export function isTestFile(filePath) {
+  if (detectFileRole(filePath) === "test")
+    return true;
   const normalized = filePath.replace(/\\/g, "/");
-  return normalized.includes(".test.") || normalized.includes(".spec.") || normalized.includes("/test/") || normalized.includes("/tests/") || normalized.includes("__tests__/") || normalized.includes("test-utils") || normalized.startsWith("test-") || normalized.includes(".fixture.") || normalized.includes(".mock.");
+  return normalized.includes("test-utils") || normalized.startsWith("test-") || normalized.includes(".fixture.") || normalized.includes(".mock.");
 }

package/extensions/dm-lens/clients/finding-delivery-gate.js

@@ -1,4 +1,7 @@
 const MS_PER_MINUTE = 60000;
+export function markUnreconciledFindings(findings) {
+  return findings.map((finding) => ({ ...finding, stale: true }));
+}
 export function formatCacheAgeLabel(scannedAt, nowMs = Date.now()) {
   if (scannedAt === undefined || scannedAt === null || scannedAt === "") {
     return "scan age unknown";
@@ -33,11 +36,11 @@ function labeled(file, description, reason, ageSource, evidence = [], extra = {}
 const RUNTIME_TURN_FILE = "clients/runtime-turn.ts";
 const LENS_DIAGNOSTICS_FILE = "tools/lens-diagnostics.ts";
 export const DELIVERY_SURFACES = {
-  "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD34 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ['store: "gitleaks"']),
-  "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD34 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ['store: "trivy-secrets"']),
-  "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDEE1️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ['store: "govulncheck"']),
+  "runtime-turn:secrets-gitleaks": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD34 secrets blocker, gitleaks cache.", ["gateFindingsByPathFreshness"], ["gitleaksGate,"]),
+  "runtime-turn:secrets-trivy": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD34 secrets blocker, trivy secrets cache.", ["gateFindingsByPathFreshness"], ["trivySecretsGate,"]),
+  "runtime-turn:govulncheck-advisory": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDEE1️ Go CVE advisory (call-site line only).", ["gateFindingsByPathFreshness"], ["scannerGates.govulncheck"]),
   "runtime-turn:unresolved-inline-blocker": gated(RUNTIME_TURN_FILE, "Turn-end re-surfaced unresolved inline blockers.", ["sweepInlineBlockerFreshness"], ["sweepInlineBlockerFreshness(runtime, cwd, {"], { evidenceMin: 2 }),
-  "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD11 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ['store: "gitleaks"', 'store: "trivy-secrets"']),
+  "runtime-turn:stale-secrets-tier": gated(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD11 demoted-secrets tier (drifted since scan).", ["gateFindingsByPathFreshness"], ["gitleaksGate,", "trivySecretsGate,"]),
   "runtime-turn:trivy-critical-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDD34 CRITICAL dependency CVE blocker (trivy).", "Package-pinned finding with no cited file:line to stat — freshness has " + "nothing to check drift against. The session_start cache can be " + "arbitrarily old, so its age is stated instead. Also routes through " + "`filterFindingsByDisposition` (#1625) first — a suppressed/false-" + "positive finding never reaches this render, so the age label and the " + "disposition filter compose rather than substitute for each other.", "TrivyResult.scannedAt", ["CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}"]),
   "runtime-turn:trivy-cve-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDEE1️ non-critical dependency CVE advisory (trivy).", "Same package-pinned shape and #1625 disposition composition as the " + "CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency CVEs (trivy, ${trivyAgeLabel}"]),
   "runtime-turn:trivy-license-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDCDC dependency license-risk advisory (trivy).", "Same package-pinned shape as the CRITICAL blocker above.", "TrivyResult.scannedAt", ["Dependency license risk (trivy, ${trivyAgeLabel}"]),
@@ -47,47 +50,40 @@ export const DELIVERY_SURFACES = {
   "runtime-turn:actionable-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end actionable-warnings advisory (ast-grep etc).", "`peekActionableWarnings` reads `_actionableWarningsThisTurn` — recorded " + "fresh from this turn's own dispatch, never a cross-turn cache.", "live"),
   "runtime-turn:code-quality-warnings-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end code-quality-warnings advisory.", "`peekCodeQualityWarnings` reads `_codeQualityWarningsThisTurn` — the " + "same per-turn accumulator shape as actionable-warnings above.", "live"),
   "runtime-turn:disposition-suppressed-notice": labeled(RUNTIME_TURN_FILE, "Turn-end running disposition-suppressed-count notice (#1616).", "A live running total accumulated from this turn's own gate/disposition " + "calls above (`dispositionSuppressedTotal`) — telemetry ABOUT the other " + "gated surfaces, not a cache of its own.", "live"),
-  "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux " + "client caches whose grace window expired).", ["gateFindingsByPathFreshness"], ['store: "late-auxiliary-findings"']),
-  "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness"], ['store: "late-runner-findings"'], { evidenceMin: 2 }),
-  "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83E\uDDEA cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " + "(`settleCascadeRuns`), but an unsettled compute can carry over to a " + "later turn (bounded by a carry cap) — this round does not freshness-" + "gate that carry-over window.", "live", [], {
-    status: "partial",
-    partialReason: "A carried-over cascade result (run.carriedTurns > 0) is rendered " + "without an age label. Follow-up: surface carriedTurns as an explicit " + "label when > 0, or route through formatCacheAgeLabel using the run's " + "own timestamp."
-  }),
-  "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn — not a " + "finding with a cited path, an absence-of-coverage disclosure computed " + "from this turn's own indeterminate-run list.", "live", [], {
-    status: "partial",
-    partialReason: "Same cascade carry-over caveat as runtime-turn:cascade-blocker."
-  }),
+  "runtime-turn:late-auxiliary-findings": gated(RUNTIME_TURN_FILE, "Turn-end late-auxiliary LSP findings (collect-later probe of aux " + "client caches whose grace window expired).", ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-auxiliary-findings": {', "applyPushedFindingPolicy(gate.live, {"]),
+  "runtime-turn:late-runner-findings": gated(RUNTIME_TURN_FILE, "Turn-end CLI runner findings collected after the post-write path.", ["gateFindingsByPathFreshness", "applyPushedFindingPolicy"], ['"late-runner-findings"'], { evidenceMin: 2 }),
+  "runtime-turn:cascade-blocker": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83E\uDDEA cascade neighbor blocker.", "Cascade results settle synchronously this turn where possible " + "(`settleCascadeRuns`), but an unsettled compute can carry over to a " + "later turn (bounded by a carry cap) — a carried-over result renders " + "with an explicit `(carried N turns · scanned Xm ago)` label (#3167, " + "#3168 F3), so the agent can tell it from a fresh observation.", "live", ["cascadeCarrySuffix("], { evidenceMin: 1 }),
+  "runtime-turn:cascade-coverage-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end cascade-coverage-gap advisories (graph/binding/budget).", "Explains what the cascade check could NOT confirm this turn — not a " + "finding with a cited path, an absence-of-coverage disclosure computed " + "from this turn's own indeterminate-run list. An advisory computed from " + "a carried indeterminate run is labeled `(carried N turns · <age>)` " + "(#3167, #3168 F4 — dropped on mixed carried/fresh buckets). The age " + "half reads `scan age unknown` on this surface today: no indeterminate-" + "run producer stamps `observedAt` (only the resolved-found plumb does, " + "`clients/cascade-format.ts`), and one unstamped carried run collapses " + "the whole bucket's age rather than claiming the stamped runs' (#3168 " + "F13). The carry COUNT is always real.", "live", ["withCarryLabel("], { evidenceMin: 3 }),
+  "cascade-format:resolved-found-run": gated("clients/cascade-format.ts", "Cold-neighbour ERROR diagnostics formatted into the turn-end cascade " + "run by `buildResolvedFoundCascadeRun` (quiet-window reconcile of a " + "cascade touch that skipped its in-lane wait).", ["applyFindingPolicy"], ["applyFindingPolicy(retained, {"]),
+  "dispatch-integration:in-lane-cascade": gated("clients/dispatch/integration.ts", "In-lane per-edit cascade neighbour ERROR diagnostics, rendered into the " + "turn-end cascade block by `computeCascadeForFile`.", ["applyCascadeDisplayPolicy"], ["cascadeDisplay("], { evidenceMin: 4 }),
   "runtime-turn:call-graph-advisory": labeled(RUNTIME_TURN_FILE, "Turn-end \uD83D\uDCCA call-graph impact advisory.", "`runtime.callGraph` is a session-lifetime in-memory structure; this " + "round does not verify or gate ITS OWN freshness policy (how/when it " + "incorporates edits made earlier in the session).", "live", [], {
     status: "partial",
     partialReason: "call-graph freshness/invalidation policy is out of this PR's scope — " + "tracked as a follow-up, not silently assumed fresh."
   }),
-  "lens-diagnostics:mode-full": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=full` report.", [
-    "applyDispositions",
-    "applyRulePolicy",
-    "reconcileProjectDiagnosticsSnapshot"
-  ], [
-    "applyDispositions(",
-    "applyRulePolicy(",
+  "lens-diagnostics:mode-full": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=full` report.", ["applyFindingPolicy", "reconcileProjectDiagnosticsSnapshot"], [
+    "applyFindingPolicy(summary.diagnostics, {",
     "reconcileProjectDiagnosticsSnapshot("
   ]),
   "lens-diagnostics:mode-all": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=all` report (widget-state read).", ["reconcileStaleWidgetFiles", "reconcileStaleWidgetDependencyBlockers"], ["reconcileStaleWidgetFiles(", "reconcileStaleWidgetDependencyBlockers("]),
   "lens-diagnostics:mode-delta": gated(LENS_DIAGNOSTICS_FILE, "`lens_diagnostics mode=delta` report (the tool's DEFAULT mode) — " + "re-serves the actionable-warnings/code-quality-warnings caches AND " + "the persisted project-diagnostics delta report.", ["gateFindingsByPathFreshness"], [
-    'store: "lens-diagnostics-delta"',
+    '"lens-diagnostics-delta": {',
     "applyDeltaFreshnessGate(",
-    'store: "lens-diagnostics-delta-project"'
+    '"lens-diagnostics-delta-project": {'
   ]),
   "widget-state:footer": gated("clients/widget-state.ts", "TUI footer blocking/error/warning tally.", ["reconcileStaleWidgetFiles", "isBlocking"], ["isBlocking(diagnostic)", "reconcileStaleWidgetFiles()"]),
   "agent-nudge:context-message": labeled("clients/agent-nudge.ts", "Post-edit file-touch nudge injected via `context`.", "Not a scanner finding store: no severity, no cited line, no cache — the " + "accumulator is drained and cleared at the moment of injection, so the " + "content IS the current state by construction.", "live"),
   "test-runner-delivery:custom-entry": labeled("clients/test-runner-delivery.ts", "Post-agent test-runner failures in a non-context custom entry.", "The cache remains authoritative for pull diagnostics and the commit guard; this surface appends only after provenance validation and an idle recheck.", "live"),
   "project-diagnostics:persisted-snapshot": gated(LENS_DIAGNOSTICS_FILE, "Cross-session persisted project-diagnostics snapshot read.", ["reconcileProjectDiagnosticsSnapshot"], ["reconcileProjectDiagnosticsSnapshot("]),
   "tool-call:stop-blocker": gated("clients/pipeline.ts", "Per-edit \uD83D\uDD34 STOP blocker output appended to the write/edit tool result.", ["dropFindingsForMissingPaths"], ['store: "stop-blocker"']),
-  "lsp-diagnostics:tool-output": gated("tools/lsp-diagnostics.ts", "`lsp_diagnostics` batch/directory sweep results. Cache hits replay through " + "the shared workspace-diagnostics cache: createWorkspaceDiagnosticsCacheContext " + "is the tool's entry, and its lookup() applies the #671/#672 freshness stack " + "(own-file mtime + reverse-dependency mtimes via isEntryFresh) plus the " + "#1095 content binding.", [
+  "lsp-diagnostics:tool-output": gated("tools/lsp-diagnostics.ts", "`lsp_diagnostics` batch/directory sweep results. Cache hits replay through " + "the shared workspace-diagnostics cache: createWorkspaceDiagnosticsCacheContext " + "is the tool's entry, and its lookup() applies the #671/#672 freshness stack " + "(own-file mtime + reverse-dependency mtimes via isEntryFresh) plus the " + "#1095 content binding. #3088: every route out of this tool — fresh, " + "cache replay, single file, directory — also passes applyProbeFindingPolicy, " + "the stored-disposition / .dm-lens.json rule-policy / inline dm-lens-ignore " + "stack the per-edit dispatch path and mode=full apply.", [
     "createWorkspaceDiagnosticsCacheContext",
     "isEntryFresh",
-    "cacheCtx.lookup"
+    "cacheCtx.lookup",
+    "applyProbeFindingPolicy"
   ], [
     "createWorkspaceDiagnosticsCacheContext(resolvedCwd)",
-    "cacheCtx.lookup(file, scopeKey)"
+    "cacheCtx.lookup(file, scopeKey)",
+    "applyProbeFindingPolicy("
   ]),
   "git-guard:commit-blocked": labeled("clients/git-guard.ts", "Git-guard commit/push \uD83D\uDD34 COMMIT BLOCKED verdict (--lens-guard).", "Synchronous preflight rejection returned inline with the failed git " + "command — no stored state is delivered, so nothing can go stale between " + "detection and delivery.", "live"),
   "shared-checkout-guard:worktree-mutation-blocked": labeled("clients/shared-checkout-guard.ts", "Shared-checkout \uD83D\uDD34 WORKING-TREE CHANGE BLOCKED verdict (--lens-checkout-guard).", "Synchronous preflight rejection returned inline with the failed git " + "command. Both inputs are read at decision time — the instance registry " + "and `git status` — so no stored finding is replayed and nothing can go " + "stale between detection and delivery.", "live"),