@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-lens/dist/clients/runtime-turn.js

@@ -0,0 +1,2333 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { buildActionableWarningsReport, formatActionableWarningsAdvisory, publishActionableWarningsReport, writeDeferredActionableWarningsReport } from "./actionable-warnings.js";
+import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
+import { appendCodeQualityWarningsHistory, buildCodeQualityWarningsReport, formatCodeQualityWarningsAdvisory, writeCodeQualityWarningsReport } from "./code-quality-warnings.js";
+import { clearGitGuardTestFailure, mergeGitGuardTestFailure, resyncGitGuardAfterInlinePolicy, writeGitGuardRecord } from "./git-guard.js";
+import { cascadeSettleWaitMs } from "./cascade-budget.js";
+import { logCascade } from "./cascade-logger.js";
+import { normalizeMapKey } from "./path-utils.js";
+import { compareOrdinal } from "./string-utils.js";
+import { resolveRunnerPath, toRunnerDisplayPath } from "./dispatch/runner-context.js";
+import { getKnipIgnorePatterns } from "./file-utils.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
+import { getFullScanWallClockMs, isWorkspaceSweepActive, runWhenWorkspaceSweepIdle, SWEEP_IDLE_SAFETY_MARGIN_MS } from "./lsp/workspace-sweep-hold.js";
+import { isTestRoleCollateral } from "./collateral-test-role.js";
+import { isSecretWarning, secretLocationKey } from "./secret-findings.js";
+import { govulncheckLane } from "./turn-end/lanes/govulncheck.js";
+import { secretsLane } from "./turn-end/lanes/secrets.js";
+import { deadCodeIssueKey, deadCodeIssues, formatDeadCodeDelta, stableFindingKey } from "./dead-code-client.js";
+import { logDeadCodeScan } from "./dead-code-logger.js";
+import { PROJECT_DIAGNOSTICS_CACHE_VERSION, writeProjectDiagnosticsDeltaReport } from "./project-diagnostics/cache.js";
+import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
+import { trivyFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/trivy.js";
+import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
+import { logLatency } from "./latency-logger.js";
+import { getLspBudgetIdleTimeoutMs, shouldShortenLspIdleTimeout } from "./lsp-budget.js";
+import { updateHeartbeat } from "./instance-registry.js";
+import { emitLensTurnFindings } from "./lens-events.js";
+import { RUNTIME_CONFIG } from "./runtime-config.js";
+import { isSubagentSession } from "./subagent-mode.js";
+import { formatRunDurationMs } from "./run-duration.js";
+import { isExcludedTestTarget, isRunnerErrorResult, RUNNERS } from "./test-runner-client.js";
+import { MAX_ADVISORY_AFFECTED_FILES, gateFindingsByPathFreshness, snapshotAdvisoryProvenance } from "./advisory-provenance.js";
+import { DEPENDENCY_DRIFT_MAX_DELIVERIES, sweepInlineBlockerFreshness } from "./blocker-freshness.js";
+import { sweepInlineBlockerPastEof } from "./blocker-past-eof.js";
+import { getLSPService } from "./lsp/index.js";
+import { drainPendingAuxCapEvictedCount, drainPendingAuxiliaryCoverage, isPendingAuxiliaryPastRearmTtl, rearmPendingAuxiliaryCoverage, MAX_LATE_AUX_REARMS, pendingAuxiliaryCoverageSize } from "./lsp/pending-aux-coverage.js";
+import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
+import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
+import { runPersistentReverify } from "./persistent-reverify.js";
+import { cascadeCarrySuffix } from "./cascade-format.js";
+import { applyPushedFindingPolicy, filterFindingsByDisposition } from "./dispatch/finding-policy.js";
+import { detectFileRole } from "./file-role.js";
+import { applyInlineBlockerPolicy, summarizeInlineBlockerPolicy } from "./inline-blocker-dispositions.js";
+import { drainPendingRunnerFindings, dropStaleRunnerFindings, pendingRunnerFindingsSize } from "./dispatch/pending-runner-findings.js";
+import { incrementDegradationCount, recordDegradationOnce } from "./degradation-ledger.js";
+import { mapWithConcurrency } from "./map-with-concurrency.js";
+import { getAmbientAbortSignal } from "./safe-spawn.js";
+import { emitBounded } from "./bounded-telemetry.js";
+import { degradeDemotedFindingBody, formatDeliveryCapNote, formatRetirementNote } from "./demoted-finding-render.js";
+import { STALE_LINE_MARKER } from "./stale-marker.js";
+import { getActiveSessionId } from "./session-lifecycle.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
+import { drainRenderedDependencyDriftFilePaths, getWidgetBlockingFilesForSweep, incrementWidgetDependencyDriftDelivery, markWidgetFileBlockersStale, recordRunner, retireWidgetDependencyDriftBlockers } from "./widget-state.js";
+const LATE_AUX_COVERAGE_GAP_DETAIL_CAP_PER_TURN = 20;
+export const TEST_RUNNER_BATCH_CONCURRENCY = 4;
+export const TEST_RUNNER_MAX_TARGETS = 12;
+export const TEST_RUNNER_BATCH_BUDGET_MS = 20000;
+export const TEST_RUNNER_MAX_DEFERRALS = 2;
+export const TEST_RUNNER_MAX_PERSISTED_TARGETS = 64;
+function deferralEntryKey(entry) {
+  return `${entry.sessionId ?? ""}\x00${normalizeMapKey(path.resolve(entry.testFile))}`;
+}
+function mergeDeferredTargets(existing, incoming) {
+  const byKey = new Map;
+  for (const entry of [...existing, ...incoming]) {
+    const key = deferralEntryKey(entry);
+    const prior = byKey.get(key);
+    if (prior && (prior.attempts ?? 0) >= (entry.attempts ?? 0))
+      continue;
+    byKey.set(key, entry);
+  }
+  return [...byKey.values()];
+}
+export async function runTestTargetsBounded(args) {
+  const results = [];
+  if (args.targets.length === 0)
+    return { results, deferred: [] };
+  let stopReason;
+  const batchAbort = new AbortController;
+  let closed = false;
+  const settledBeforeClose = new Set;
+  const budgetMs = Math.max(0, args.budgetMs);
+  const deadline = Date.now() + budgetMs;
+  const shouldStop = () => {
+    if (stopReason !== undefined)
+      return true;
+    if (args.signal?.aborted) {
+      stopReason = "abort";
+      return true;
+    }
+    if (Date.now() >= deadline) {
+      stopReason = "budget";
+      return true;
+    }
+    return false;
+  };
+  const pool = mapWithConcurrency(args.targets.map((target, index) => ({ target, index })), Math.max(1, args.concurrency), async ({ target, index }) => {
+    if (shouldStop())
+      return;
+    const running = args.run(target, batchAbort.signal);
+    const stamp = running.then((value) => {
+      if (closed)
+        return;
+      settledBeforeClose.add(index);
+      results.push({ status: "fulfilled", value });
+    }, (reason) => {
+      if (closed)
+        return;
+      settledBeforeClose.add(index);
+      results.push({ status: "rejected", reason });
+    });
+    await stamp;
+  });
+  pool.catch(() => {});
+  await new Promise((resolve) => {
+    let settled = false;
+    const finish = (reason) => {
+      if (settled)
+        return;
+      settled = true;
+      if (reason !== undefined)
+        stopReason ??= reason;
+      closed = true;
+      batchAbort.abort();
+      clearTimeout(timer);
+      args.signal?.removeEventListener("abort", onAbort);
+      resolve();
+    };
+    const onAbort = () => finish("abort");
+    const timer = setTimeout(() => finish("budget"), budgetMs);
+    timer.unref?.();
+    if (args.signal?.aborted)
+      finish("abort");
+    else
+      args.signal?.addEventListener("abort", onAbort, { once: true });
+    pool.then(() => finish(), () => finish());
+  });
+  return {
+    results,
+    deferred: args.targets.filter((_, index) => !settledBeforeClose.has(index)),
+    stopReason
+  };
+}
+function wouldPoisonCache(prev, next) {
+  return !next.success && prev?.data.success === true;
+}
+let lspIdleResetTimeout = null;
+let pendingSweepRearm = null;
+function emitIdleResetReporterWarning(reportErr) {
+  try {
+    process.emitWarning(`dm-lens LSP idle reset error reporter failed: ${reportErr}`, { code: "DM_LENS_LSP_IDLE_RESET_REPORTER_FAILED" });
+  } catch {}
+}
+function reportIdleResetError(onError, err) {
+  try {
+    onError?.(err);
+  } catch (reportErr) {
+    emitIdleResetReporterWarning(reportErr);
+  }
+}
+function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
+  if (lspIdleResetTimeout) {
+    clearTimeout(lspIdleResetTimeout);
+  }
+  if (pendingSweepRearm) {
+    pendingSweepRearm.cancelled = true;
+    pendingSweepRearm = null;
+  }
+  lspIdleResetTimeout = setTimeout(() => {
+    lspIdleResetTimeout = null;
+    if (isWorkspaceSweepActive()) {
+      const rearmToken = { cancelled: false };
+      pendingSweepRearm = rearmToken;
+      runWhenWorkspaceSweepIdle(() => {
+        if (rearmToken.cancelled)
+          return;
+        if (pendingSweepRearm === rearmToken)
+          pendingSweepRearm = null;
+        scheduleLSPIdleReset(resetFn, delayMs, options);
+      });
+      return;
+    }
+    try {
+      if (options.isCurrentSession && !options.isCurrentSession()) {
+        return;
+      }
+      if (options.isPrimarySession && !options.isPrimarySession()) {
+        return;
+      }
+      resetFn();
+    } catch (err) {
+      reportIdleResetError(options.onError, err);
+    }
+  }, delayMs);
+  lspIdleResetTimeout.unref();
+}
+const DEFAULT_LSP_IDLE_RESET_MS = 240000;
+function sweepDerivedFloorMs() {
+  return getFullScanWallClockMs() + SWEEP_IDLE_SAFETY_MARGIN_MS;
+}
+function getBaseLspIdleResetMs() {
+  return Math.max(DEFAULT_LSP_IDLE_RESET_MS, sweepDerivedFloorMs());
+}
+function getShortenedLspIdleResetMs() {
+  return Math.max(getLspBudgetIdleTimeoutMs(), sweepDerivedFloorMs());
+}
+export function getEffectiveLspIdleResetMs() {
+  return isSubagentSession() || shouldShortenLspIdleTimeout() ? getShortenedLspIdleResetMs() : getBaseLspIdleResetMs();
+}
+export function cancelLSPIdleReset() {
+  if (lspIdleResetTimeout) {
+    clearTimeout(lspIdleResetTimeout);
+    lspIdleResetTimeout = null;
+  }
+  if (pendingSweepRearm) {
+    pendingSweepRearm.cancelled = true;
+    pendingSweepRearm = null;
+  }
+}
+function capTurnEndMessage(content) {
+  const maxLines = RUNTIME_CONFIG.turnEnd.maxLines;
+  const maxChars = RUNTIME_CONFIG.turnEnd.maxChars;
+  let out = content;
+  const lines = out.split(`
+`);
+  if (lines.length > maxLines) {
+    out = `${lines.slice(0, maxLines).join(`
+`)}
+... (truncated)`;
+  }
+  if (out.length > maxChars) {
+    out = `${out.slice(0, maxChars)}
+... (truncated)`;
+  }
+  return out;
+}
+export async function handleTurnEnd(deps) {
+  const { ctxCwd, getFlag, dbg, runtime, cacheManager, knipClient, deadCodeClients, depChecker, testRunnerClient, sessionId, host = "pi", owner, resetLSPService, resetFormatService } = deps;
+  const turnIndexAtDispatch = runtime.turnIndex;
+  const clearOwnedTurnState = () => {
+    if (runtime.turnIndex !== turnIndexAtDispatch) {
+      dbg(`turn_end: retaining newer turn state (dispatch=${turnIndexAtDispatch}, current=${runtime.turnIndex})`);
+      return;
+    }
+    cacheManager.clearTurnState(cwd, currentOwner);
+  };
+  updateHeartbeat().catch(() => {});
+  const cwd = ctxCwd ?? process.cwd();
+  let turnState = cacheManager.readTurnState(cwd);
+  const currentOwner = {
+    ...owner ?? {
+      kind: "pi",
+      id: runtime.telemetrySessionId,
+      pid: process.pid,
+      lastSeen: new Date().toISOString()
+    },
+    sessionStartedAt: owner?.sessionStartedAt ?? runtime.sessionStartedAt
+  };
+  const access = cacheManager.getTurnStateAccess(cwd, currentOwner);
+  const gateOwnerLabel = turnState.owner ? `${turnState.owner.kind}:${turnState.owner.id}` : turnState.sessionId ? `legacy:${turnState.sessionId}` : "none";
+  const sameProcessPiSessionHandoff = access === "foreign-live" && currentOwner.kind === "pi" && turnState.owner?.kind === "pi" && turnState.owner.pid === process.pid && turnState.owner.id !== currentOwner.id;
+  if (access === "foreign-live" && !sameProcessPiSessionHandoff) {
+    dbg(`turn_end: foreign live owner retained (${turnState.owner?.kind ?? "legacy"}:${turnState.owner?.id ?? turnState.sessionId})`);
+    return;
+  }
+  if (access === "available" && (turnState.files || turnState.owner || turnState.sessionId)) {
+    dbg("turn_end: evicting stale turn-state owner");
+    clearOwnedTurnState();
+    turnState = cacheManager.readTurnState(cwd);
+  }
+  const files = Object.keys(turnState.files);
+  let widgetDemotedFindingsRetired = 0;
+  for (const wPath of drainRenderedDependencyDriftFilePaths()) {
+    const deliveryCount = incrementWidgetDependencyDriftDelivery(wPath);
+    if (deliveryCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+      const capRetired = retireWidgetDependencyDriftBlockers(wPath);
+      if (capRetired) {
+        widgetDemotedFindingsRetired += 1;
+        incrementDegradationCount({
+          kind: "demoted-finding-retired",
+          subject: `widget-blocker:${toRunnerDisplayPath(cwd, wPath)}`,
+          reason: `capped after ${deliveryCount} deliveries with no re-run; hidden from the dm-lens footer, still listed by lens_diagnostics mode=all — re-run can still confirm`
+        });
+      }
+    }
+  }
+  if (files.length === 0 && !runtime.hasCascadeRuns()) {
+    if (getFlag("lens-guard") && !runtime.gitGuardHasBlockers) {
+      const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
+        cacheManager.clearCache("turn-end-findings", cwd);
+      }
+    }
+    const idleResetMs = getEffectiveLspIdleResetMs();
+    dbg(`turn_end: no modified files, scheduling LSP idle reset (${idleResetMs / 1000}s)`);
+    if (!getFlag("no-lsp")) {
+      const sessionGeneration = runtime.sessionGeneration;
+      scheduleLSPIdleReset(resetLSPService, idleResetMs, {
+        isCurrentSession: () => runtime.isCurrentSession(sessionGeneration),
+        isPrimarySession: () => {
+          const activePrimarySessionId = getActiveSessionId();
+          return activePrimarySessionId === undefined || activePrimarySessionId === runtime.telemetrySessionId;
+        },
+        onError: (err) => dbg(`lsp idle reset failed: ${err}`)
+      });
+    }
+    resetFormatService();
+    if (pendingRunnerFindingsSize() === 0)
+      return;
+  }
+  if (files.length > 0 && (lspIdleResetTimeout || pendingSweepRearm)) {
+    cancelLSPIdleReset();
+    dbg("turn_end: cancelled pending LSP idle reset (active editing)");
+  }
+  dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
+  if (cacheManager.isMaxCyclesExceeded(cwd)) {
+    dbg("turn_end: max cycles exceeded, clearing state and forcing through");
+    clearOwnedTurnState();
+    runtime.fixedThisTurn.clear();
+    resetFormatService();
+    return;
+  }
+  const turnEndStart = Date.now();
+  const blockerParts = [];
+  const staleSecretParts = [];
+  const advisoryParts = [];
+  const projectDiagnosticsDelta = [];
+  const projectDiagnosticsSources = new Set;
+  const blockerPastEofStart = Date.now();
+  const blockerPastEof = sweepInlineBlockerPastEof(runtime, cwd);
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "blocker_past_eof_sweep",
+    durationMs: Date.now() - blockerPastEofStart,
+    metadata: {
+      total: blockerPastEof.total,
+      checked: blockerPastEof.checked,
+      demoted: blockerPastEof.demoted
+    }
+  });
+  const blockerFreshnessStart = Date.now();
+  const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+    ...deps.signal === undefined ? {} : { signal: deps.signal },
+    additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
+      filePath: row.filePath,
+      recordedAtMs: row.recordedAtMs,
+      demote: () => markWidgetFileBlockersStale(row.filePath, "dependency-drift")
+    }))
+  });
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "blocker_freshness_sweep",
+    durationMs: Date.now() - blockerFreshnessStart,
+    metadata: {
+      total: blockerFreshness.total,
+      kept: blockerFreshness.kept,
+      revalidated: blockerFreshness.revalidated,
+      alreadyStale: blockerFreshness.alreadyStale,
+      truncatedImports: blockerFreshness.truncatedImports,
+      selfHealed: blockerFreshness.selfHealed,
+      selfUnverifiable: blockerFreshness.selfUnverifiable,
+      hashBudgetExhausted: blockerFreshness.hashBudgetExhausted
+    }
+  });
+  const unresolvedBlockers = runtime.getInlineBlockersSnapshot();
+  let demotedFindingsRetired = 0;
+  const pendingDependencyDriftDeliveries = [];
+  const inlinePolicyEntries = [];
+  const policySuppressedPaths = [];
+  const inlinePolicyStart = Date.now();
+  for (const record of unresolvedBlockers) {
+    const { filePath: bPath, summary, stale, staleReason } = record;
+    const displayPath = toRunnerDisplayPath(cwd, bPath);
+    const tally = { displayPath, sources: record.sources };
+    if (stale) {
+      inlinePolicyEntries.push({ ...tally, stale: true });
+      const deadLines = blockerPastEof.deadLinesByPath.get(bPath) ?? [];
+      const degraded = degradeDemotedFindingBody(summary, { deadLines });
+      const retired = runtime.retireDemotedPastEofBlocker(bPath, deadLines);
+      let retirementNote;
+      if (retired) {
+        demotedFindingsRetired += 1;
+        incrementDegradationCount({
+          kind: "demoted-finding-retired",
+          subject: `inline-blocker:${displayPath}`,
+          reason: `file shrank past cited line(s) ${deadLines.join(", ")}; retired after one degraded delivery`
+        });
+        retirementNote = formatRetirementNote(deadLines);
+      } else if (staleReason === "dependency-drift") {
+        const tentativeCount = runtime.peekInlineBlockerStaleDeliveryCount(bPath) + 1;
+        if (tentativeCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+          retirementNote = formatDeliveryCapNote(tentativeCount);
+        }
+        pendingDependencyDriftDeliveries.push(() => {
+          const deliveryCount = runtime.incrementInlineBlockerStaleDelivery(bPath);
+          if (deliveryCount >= DEPENDENCY_DRIFT_MAX_DELIVERIES) {
+            const capRetired = runtime.retireDemotedDependencyDriftBlocker(bPath);
+            if (capRetired) {
+              demotedFindingsRetired += 1;
+              incrementDegradationCount({
+                kind: "demoted-finding-retired",
+                subject: `inline-blocker:${displayPath}`,
+                reason: `capped after ${deliveryCount} deliveries with no re-run; re-run can still confirm`
+              });
+            }
+          }
+        });
+      }
+      advisoryParts.push(`${STALE_LINE_MARKER} ${displayPath}:
+${degraded.body}` + (retirementNote ? `
+${retirementNote}` : ""));
+    } else {
+      const policy = applyInlineBlockerPolicy(record, cwd);
+      inlinePolicyEntries.push({ ...tally, stale: false, outcome: policy });
+      if (policy.body === undefined) {
+        policySuppressedPaths.push(bPath);
+        continue;
+      }
+      const suppressedNote = policy.suppressed > 0 ? ` (suppressed by disposition: ${policy.suppressed} finding(s))` : "";
+      blockerParts.push(`Unresolved from this turn — ${displayPath}${suppressedNote}:
+${policy.body}`);
+    }
+  }
+  const guardLatchBefore = runtime.gitGuardHasBlockers;
+  resyncGitGuardAfterInlinePolicy({
+    runtime,
+    suppressedFilePaths: policySuppressedPaths
+  });
+  if (inlinePolicyEntries.length > 0) {
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "inline_blocker_policy",
+      durationMs: Date.now() - inlinePolicyStart,
+      metadata: {
+        ...summarizeInlineBlockerPolicy(inlinePolicyEntries),
+        guardFilesSuppressed: policySuppressedPaths.length,
+        guardLatchCleared: guardLatchBefore && !runtime.gitGuardHasBlockers
+      }
+    });
+  }
+  const cascadeSettleStart = Date.now();
+  const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true });
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "cascade_settle_wait",
+    durationMs: Date.now() - cascadeSettleStart,
+    metadata: { settled, timedOut }
+  });
+  const t0 = Date.now();
+  const cascadeRuns = runtime.consumeCascadeRuns().filter((run) => {
+    const originSeq = run.origin?.projectSeq;
+    const originTurn = run.origin?.turnSeq;
+    if (originSeq !== undefined) {
+      const changedSince = runtime.getFilesChangedSince(originSeq);
+      if (changedSince.length > 0) {
+        const changedSet = new Set(changedSince);
+        const primaryKey = normalizeMapKey(path.resolve(run.filePath));
+        const neighborKeys = [
+          ...(run.result?.neighbors ?? []).map((n) => n.filePath),
+          ...run.selectedNeighborPaths ?? []
+        ].map((filePath) => normalizeMapKey(path.resolve(filePath)));
+        const supersededByOwnFile = changedSet.has(primaryKey) || neighborKeys.some((k) => changedSet.has(k));
+        if (supersededByOwnFile) {
+          logCascade({
+            phase: "cascade_carry_over_drop",
+            filePath: run.filePath,
+            neighborCount: run.neighborCount,
+            diagnosticCount: run.diagnosticCount,
+            reason: "superseded_by_later_write",
+            metadata: {
+              originProjectSeq: originSeq,
+              projectSeq: runtime.projectSeq,
+              originTurnSeq: originTurn,
+              turnIndex: runtime.turnIndex,
+              carriedTurns: run.carriedTurns,
+              changedFiles: changedSince
+            }
+          });
+          return false;
+        }
+      }
+    }
+    return true;
+  });
+  const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+  let carriedRunsRendered = 0;
+  let labeledAdvisories = 0;
+  const carriedMetaByResult = new Map;
+  for (const r of cascadeRuns) {
+    if (r.result && (r.carriedTurns ?? 0) > 0 && r.carriedTurns !== undefined) {
+      carriedMetaByResult.set(r.result, {
+        carriedTurns: r.carriedTurns,
+        observedAt: r.observedAt
+      });
+    }
+  }
+  const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files[0] ?? cwd;
+  if (cascadeResults.length > 0) {
+    const seen = new Map;
+    for (const result of cascadeResults) {
+      seen.set(normalizeMapKey(result.filePath), result);
+    }
+    const neighborOwner = new Map;
+    for (const result of [...seen.values()].reverse()) {
+      const pk = normalizeMapKey(result.filePath);
+      for (const n of result.neighbors) {
+        const nk = normalizeMapKey(n.filePath);
+        if (!neighborOwner.has(nk))
+          neighborOwner.set(nk, pk);
+      }
+    }
+    const parts = [];
+    let injectedNeighborCount = 0;
+    let injectedDiagnosticCount = 0;
+    let suppressedByOwnership = 0;
+    for (const result of seen.values()) {
+      const pk = normalizeMapKey(result.filePath);
+      const ownsAny = result.neighbors.some((n) => neighborOwner.get(normalizeMapKey(n.filePath)) === pk);
+      if (ownsAny && result.formatted) {
+        const carryMeta = carriedMetaByResult.get(result);
+        const carrySuffix = cascadeCarrySuffix(carryMeta?.carriedTurns, carryMeta?.observedAt);
+        parts.push(carrySuffix ? `${result.formatted}
+${carrySuffix}` : result.formatted);
+        if (carrySuffix)
+          carriedRunsRendered += 1;
+        injectedNeighborCount += result.neighbors.length;
+        injectedDiagnosticCount += result.neighbors.reduce((s, n) => s + n.diagnostics.length, 0);
+      } else if (!ownsAny && result.formatted) {
+        suppressedByOwnership++;
+      }
+    }
+    const neighborFilesWithErrors = cascadeResults.flatMap((r) => r.neighbors).filter((n) => n.diagnostics.length > 0).map((n) => n.filePath);
+    const uniqueNeighborFiles = [...new Set(neighborFilesWithErrors)];
+    let testSuggestionCount = 0;
+    if (uniqueNeighborFiles.length > 0 && typeof testRunnerClient.suggestTestFiles === "function") {
+      const testSuggestions = testRunnerClient.suggestTestFiles(uniqueNeighborFiles, cwd);
+      testSuggestionCount = testSuggestions.length;
+      logCascade({
+        phase: "cascade_test_targets",
+        filePath: cascadeLogFilePath,
+        neighborCount: uniqueNeighborFiles.length,
+        metadata: {
+          neighborFiles: uniqueNeighborFiles.slice(0, 10),
+          suggestedTestFiles: testSuggestions.slice(0, 10).map((s) => s.testFile),
+          runner: testSuggestions[0]?.runner,
+          truncated: testSuggestions.length > 10,
+          zeroSuggestions: testSuggestions.length === 0
+        }
+      });
+      if (testSuggestions.length > 0) {
+        const testLines = testSuggestions.slice(0, 5).map((s) => `  ${toRunnerDisplayPath(cwd, s.testFile)} (${s.runner})`);
+        let testSection = `\uD83E\uDDEA Likely tests for affected neighbors:
+${testLines.join(`
+`)}`;
+        if (testSuggestions.length > 5) {
+          testSection += `
+  ... and ${testSuggestions.length - 5} more`;
+        }
+        parts.push(testSection);
+      }
+    }
+    if (parts.length > 0) {
+      const section = parts.join(`
+
+`);
+      blockerParts.push(section);
+      logCascade({
+        phase: "cascade_injected",
+        filePath: cascadeLogFilePath,
+        neighborCount: injectedNeighborCount,
+        diagnosticCount: injectedDiagnosticCount,
+        metadata: {
+          sectionChars: section.length,
+          testSuggestionCount,
+          suppressedByOwnership
+        }
+      });
+    }
+    logCascade({
+      phase: "cascade_turn_end",
+      filePath: cascadeLogFilePath,
+      neighborCount: cascadeResults.reduce((s, r) => s + r.neighbors.length, 0),
+      diagnosticCount: cascadeResults.reduce((s, r) => s + r.neighbors.reduce((ns, n) => ns + n.diagnostics.length, 0), 0),
+      metadata: {
+        fileCount: cascadeResults.length,
+        mergedResults: seen.size
+      }
+    });
+  }
+  const indeterminateRuns = cascadeRuns.filter((r) => r.indeterminate);
+  if (indeterminateRuns.length > 0) {
+    const buildAdvisory = (runs, frame) => {
+      if (runs.length === 0)
+        return;
+      const byDetail = new Map;
+      for (const r of runs) {
+        const detail = r.indeterminate?.detail ?? frame.fallbackDetail(r);
+        const files = byDetail.get(detail) ?? [];
+        files.push(toRunnerDisplayPath(cwd, r.filePath));
+        byDetail.set(detail, files);
+      }
+      const lines = [];
+      for (const [detail, filesRaw] of byDetail) {
+        const files = [...new Set(filesRaw)];
+        const shown = files.slice(0, 5).join(", ");
+        const more = files.length > 5 ? ` (+${files.length - 5} more)` : "";
+        lines.push(`  • ${detail}: ${shown}${more}`);
+      }
+      const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath))).size;
+      const reasons = [...byDetail.keys()].join("; ");
+      return `${frame.lead(fileCount, reasons)}
+${lines.join(`
+`)}`;
+    };
+    const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" && r.indeterminate?.reason !== "excluded_by_role" && r.indeterminate?.reason !== "budget_truncated" && r.indeterminate?.budget === undefined);
+    const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" && r.indeterminate?.budget === undefined);
+    const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" || r.indeterminate?.budget !== undefined);
+    const withCarryLabel = (advisory, runs) => {
+      if (advisory === undefined)
+        return;
+      const carried = runs.filter((r) => (r.carriedTurns ?? 0) > 0);
+      if (carried.length === 0 || carried.length !== runs.length) {
+        return advisory;
+      }
+      const stamps = carried.map((r) => r.observedAt);
+      const observedAt = stamps.every((s) => s !== undefined) ? Math.min(...stamps) : undefined;
+      const suffix = cascadeCarrySuffix(carried[0]?.carriedTurns, observedAt);
+      if (!suffix)
+        return advisory;
+      labeledAdvisories += 1;
+      return `${advisory}
+${suffix}`;
+    };
+    const graphAdvisory = withCarryLabel(buildAdvisory(graphRuns, {
+      lead: (fileCount, reasons) => `Cascade could not compute downstream impact for ${fileCount} edited file(s) this turn — ` + `the review graph was unavailable (${reasons}), so their dependents were not ` + `cascade-checked and a clean cascade result does not cover them.`,
+      fallbackDetail: (r) => r.indeterminate?.reason === "missing_node" ? "changed file not in the review graph" : "review graph unavailable"
+    }), graphRuns);
+    if (graphAdvisory)
+      advisoryParts.push(graphAdvisory);
+    const bindingAdvisory = withCarryLabel(buildAdvisory(bindingRuns, {
+      lead: (fileCount, reasons) => `Cascade identified dependents for ${fileCount} edited file(s) this turn, but their ` + `diagnostics could not be freshly confirmed (${reasons}) and were withheld — a clean ` + `cascade result does not cover them.`,
+      fallbackDetail: () => "cascade diagnostics withheld (binding rejected)"
+    }), bindingRuns);
+    if (bindingAdvisory)
+      advisoryParts.push(bindingAdvisory);
+    const budgetAdvisory = withCarryLabel(buildAdvisory(budgetRuns, {
+      lead: (fileCount, reasons) => `Cascade checked the selected neighbors for ${fileCount} edited file(s) this turn, ` + `but some eligible dependents were not checked because the cascade budget ` + `was exhausted (${reasons}); a clean cascade result does not cover them.`,
+      fallbackDetail: (r) => {
+        const budget = r.indeterminate?.budget;
+        if (!budget)
+          return "cascade budget omitted eligible dependents";
+        const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
+        return budget.transitiveTruncated ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated` : detail;
+      }
+    }), budgetRuns);
+    if (budgetAdvisory)
+      advisoryParts.push(budgetAdvisory);
+    const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
+    const byFile = indeterminateRuns.map((r) => ({
+      file: toRunnerDisplayPath(cwd, r.filePath),
+      reason: r.indeterminate?.reason,
+      ...r.indeterminate?.detail && { detail: r.indeterminate.detail },
+      ...r.indeterminate?.budget && { budget: r.indeterminate.budget },
+      ...r.indeterminate?.diagnostic && {
+        diagnostic: r.indeterminate.diagnostic
+      }
+    }));
+    logCascade({
+      phase: "cascade_indeterminate",
+      filePath: indeterminateRuns[0]?.filePath ?? files[0] ?? cwd,
+      metadata: {
+        fileCount,
+        reasons: indeterminateRuns.map((r) => r.indeterminate?.reason),
+        byFile: byFile.slice(0, 20),
+        ...byFile.length > 20 && { byFileTruncated: byFile.length - 20 }
+      }
+    });
+  }
+  if (carriedRunsRendered > 0 || labeledAdvisories > 0) {
+    logCascade({
+      phase: "cascade_carry_rendered",
+      filePath: cascadeLogFilePath,
+      metadata: { carriedRunsRendered, labeledAdvisories }
+    });
+  }
+  const cascadeSkipped = {
+    blockers: 0,
+    non_code: 0,
+    no_neighbors: 0,
+    clean: 0,
+    indeterminate: 0,
+    error: 0
+  };
+  for (const r of cascadeRuns) {
+    if (r.skipReason)
+      cascadeSkipped[r.skipReason] = (cascadeSkipped[r.skipReason] ?? 0) + 1;
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "cascade_merge",
+    durationMs: Date.now() - t0,
+    metadata: {
+      runsTotal: cascadeRuns.length,
+      resultCount: cascadeResults.length,
+      neighborCount: cascadeRuns.reduce((s, r) => s + r.neighborCount, 0),
+      diagnosticCount: cascadeRuns.reduce((s, r) => s + r.diagnosticCount, 0),
+      skipped: cascadeSkipped
+    }
+  });
+  const t2 = Date.now();
+  let knipMeta = {};
+  if (runtime.isStartupScanInFlight("knip")) {
+    dbg("turn_end: skipping knip (startup scan still in flight)");
+    knipMeta = { skipped: true };
+  } else {
+    const prevKnip = cacheManager.readCache("knip", cwd);
+    const previousFailedHard = prevKnip && !prevKnip.data.success && !prevKnip.data.failureKind && /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prevKnip.data.summary);
+    if (previousFailedHard) {
+      dbg(`turn_end: skipping knip after recent failure: ${prevKnip.data.summary}`);
+      knipMeta = { skipped: true, reason: prevKnip.data.summary };
+    } else {
+      const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns(), {
+        projectSeq: runtime.projectSeq
+      });
+      const knipWouldPoison = wouldPoisonCache(prevKnip, knipResult);
+      if (knipWouldPoison) {
+        dbg(`turn_end: keeping last good knip cache; this run failed: ${knipResult.summary}`);
+      } else {
+        cacheManager.writeCache("knip", knipResult, cwd);
+      }
+      knipMeta = {
+        execution: knipResult.execution ?? "executed",
+        success: knipResult.success,
+        totalIssues: knipResult.issues.length,
+        newIssues: 0,
+        blockerIssues: 0,
+        dispositionSuppressed: 0,
+        ...!knipResult.success && { reason: knipResult.summary },
+        ...knipResult.failureKind && { failureKind: knipResult.failureKind },
+        ...knipWouldPoison && { cacheKept: true }
+      };
+      if (knipResult.success && knipResult.issues.length > 0) {
+        const issueKey = (i) => stableFindingKey(i.type, i.file, i.name, i.package);
+        const prevKeys = new Set((prevKnip?.data?.issues ?? []).map(issueKey));
+        const modifiedSet = new Set(files.map((f) => resolveRunnerPath(cwd, f)));
+        const newIssues = knipResult.issues.filter((issue) => {
+          if (prevKeys.has(issueKey(issue)))
+            return false;
+          if (!issue.file)
+            return false;
+          const abs = resolveRunnerPath(cwd, issue.file);
+          return modifiedSet.has(abs);
+        });
+        knipMeta.newIssues = newIssues.length;
+        if (newIssues.length > 0) {
+          projectDiagnosticsDelta.push(...knipIssuesToProjectDiagnostics(cwd, newIssues));
+          projectDiagnosticsSources.add("knip");
+        }
+        const knipPaired = newIssues.flatMap((issue) => knipIssuesToProjectDiagnostics(cwd, [issue]).map((diagnostic) => ({
+          issue,
+          diagnostic
+        })));
+        const knipFiltered = filterFindingsByDisposition(knipPaired, cwd, (pair) => pair.diagnostic);
+        const knipDeliverable = {
+          kept: knipFiltered.kept.map((pair) => pair.issue),
+          suppressed: knipFiltered.suppressed
+        };
+        knipMeta.dispositionSuppressed = knipDeliverable.suppressed;
+        const blockerIssues = knipDeliverable.kept.filter((i) => i.type === "unlisted" || i.type === "bin");
+        knipMeta.blockerIssues = blockerIssues.length;
+        if (blockerIssues.length > 0) {
+          let report = `\uD83D\uDD34 New unresolved imports/deps in modified code (Knip):
+`;
+          let firstPath = null;
+          for (const issue of blockerIssues.slice(0, 5)) {
+            const display = issue.file ? toRunnerDisplayPath(cwd, issue.file) : "(unknown)";
+            if (!firstPath && display !== "(unknown)")
+              firstPath = display;
+            report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.type}: ${issue.name}
+`;
+          }
+          if (firstPath) {
+            report += `  First location: ${firstPath}
+`;
+          }
+          blockerParts.push(report);
+        }
+        const unusedExportDelta = knipDeliverable.kept.filter((i) => i.type === "export" || i.type === "enumMember");
+        if (unusedExportDelta.length > 0) {
+          let report = `⚠️ Newly unused exports in files you edited — check if callers need updating (Knip):
+`;
+          for (const issue of unusedExportDelta.slice(0, 5)) {
+            const display = issue.file ? toRunnerDisplayPath(cwd, issue.file) : "(unknown)";
+            report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.name}
+`;
+          }
+          advisoryParts.push(report);
+        }
+      }
+    }
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "knip",
+    durationMs: Date.now() - t2,
+    metadata: knipMeta
+  });
+  const tDeadCode = Date.now();
+  const deadCodeMeta = {};
+  if (runtime.isStartupScanInFlight("dead-code")) {
+    dbg("turn_end: skipping dead-code (startup scan still in flight)");
+    deadCodeMeta.skipped = true;
+    deadCodeMeta.reason = "startup_scan_in_flight";
+  } else if (deadCodeClients.length === 0) {
+    deadCodeMeta.reason = "no_clients";
+  } else {
+    let modifiedSet = null;
+    const modifiedFiles = () => modifiedSet ??= new Set(files.map((f) => resolveRunnerPath(cwd, f)));
+    let newIssueTotal = 0;
+    let deadCodeDispositionSuppressed = 0;
+    const reasons = [];
+    try {
+      for (const client of deadCodeClients) {
+        if (!client.detect(cwd)) {
+          reasons.push(`${client.id}:not_detected`);
+          continue;
+        }
+        if (![...modifiedFiles()].some((f) => client.owns(f))) {
+          reasons.push(`${client.id}:no_owned_files`);
+          continue;
+        }
+        const cacheKey = `dead-code-${client.id}`;
+        const prev = cacheManager.readCache(cacheKey, cwd);
+        if (prev && !prev.data.success && /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prev.data.summary)) {
+          dbg(`turn_end: skipping dead-code after failure: ${prev.data.summary}`);
+          deadCodeMeta.skipped = true;
+          reasons.push(`${client.id}:backoff:${prev.data.summary}`);
+          continue;
+        }
+        const startMs = Date.now();
+        try {
+          const result = await client.analyze(cwd);
+          const durationMs = Date.now() - startMs;
+          if (wouldPoisonCache(prev, result)) {
+            dbg(`turn_end: keeping last good dead-code(${client.id}) cache; this run failed: ${result.summary}`);
+            deadCodeMeta.cacheKept = true;
+          } else {
+            cacheManager.writeCache(cacheKey, result, cwd, {
+              scanDurationMs: durationMs
+            });
+          }
+          logDeadCodeScan({
+            language: client.language,
+            success: result.success,
+            cached: false,
+            unusedExports: result.unusedExports.length,
+            unusedFiles: result.unusedFiles.length,
+            unusedDeps: result.unusedDeps.length,
+            unlistedDeps: result.unlistedDeps.length,
+            durationMs: result.durationMs ?? durationMs,
+            ...!result.success && { reason: result.summary }
+          });
+          deadCodeMeta.success = result.success;
+          if (!result.success) {
+            reasons.push(`${client.id}:scan_failed:${result.summary}`);
+            continue;
+          }
+          deadCodeMeta.totalIssues = (deadCodeMeta.totalIssues ?? 0) + deadCodeIssues(result).length;
+          if (!prev?.data.success) {
+            reasons.push(`${client.id}:no_previous_scan`);
+            continue;
+          }
+          const prevKeys = new Set(deadCodeIssues(prev.data).map(deadCodeIssueKey));
+          const modified = modifiedFiles();
+          const newIssues = deadCodeIssues(result).filter((issue) => {
+            if (prevKeys.has(deadCodeIssueKey(issue)))
+              return false;
+            if (!issue.file)
+              return false;
+            return modified.has(resolveRunnerPath(cwd, issue.file));
+          });
+          if (newIssues.length === 0) {
+            reasons.push(`${client.id}:clean`);
+            continue;
+          }
+          newIssueTotal += newIssues.length;
+          projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
+          projectDiagnosticsSources.add("dead-code");
+          const deadCodeDeliverable = filterFindingsByDisposition(newIssues, cwd, (issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
+          deadCodeDispositionSuppressed += deadCodeDeliverable.suppressed;
+          if (deadCodeDeliverable.kept.length === 0) {
+            reasons.push(`${client.id}:all_disposed`);
+            continue;
+          }
+          advisoryParts.push(formatDeadCodeDelta(deadCodeDeliverable.kept, result.language));
+        } catch (err) {
+          dbg(`turn_end: dead-code(${client.id}) failed: ${err}`);
+          reasons.push(`${client.id}:threw`);
+        }
+      }
+    } catch (err) {
+      dbg(`turn_end: dead-code block failed: ${err}`);
+      reasons.push("block_threw");
+    }
+    deadCodeMeta.newIssues = newIssueTotal;
+    deadCodeMeta.dispositionSuppressed = deadCodeDispositionSuppressed;
+    if (reasons.length > 0)
+      deadCodeMeta.reason = reasons.join(",");
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "dead-code",
+    durationMs: Date.now() - tDeadCode,
+    metadata: deadCodeMeta
+  });
+  let dispositionSuppressedTotal = 0;
+  const dispositionSuppressedByLane = {};
+  function recordDispositionSuppressed(lane, count) {
+    if (count <= 0)
+      return;
+    dispositionSuppressedTotal += count;
+    dispositionSuppressedByLane[lane] = (dispositionSuppressedByLane[lane] ?? 0) + count;
+  }
+  const scannerCacheReads = new Map;
+  const scannerStoresUnread = [];
+  function readScannerCache(scanner) {
+    let pending = scannerCacheReads.get(scanner);
+    if (pending === undefined) {
+      pending = deps.signal?.aborted ? Promise.resolve(null) : bounded(cacheManager.readCacheAsync(scanner, cwd), {
+        ms: HOOK_WALL_BUDGET_MS.turn_end,
+        signal: deps.signal,
+        hook: "turn_end",
+        label: `readScannerCache:${scanner}`
+      }).then((entry) => {
+        if (entry === undefined)
+          scannerStoresUnread.push(scanner);
+        return entry ?? null;
+      });
+      scannerCacheReads.set(scanner, pending);
+    }
+    return pending;
+  }
+  const laneCtx = {
+    cwd,
+    signal: deps.signal,
+    readScannerCache,
+    peekActionableWarnings: () => runtime.peekActionableWarnings()
+  };
+  const govSources = await govulncheckLane.collect(laneCtx);
+  const trivyCacheEntry = await readScannerCache("trivy");
+  const secretsSources = await secretsLane.collect(laneCtx);
+  if (scannerStoresUnread.length > 0) {
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "scanner_cache_read_abandoned",
+      durationMs: 0,
+      metadata: {
+        stores: scannerStoresUnread.join("+"),
+        aborted: deps.signal?.aborted === true
+      }
+    });
+  }
+  const scannerGates = gateFindingsByPathFreshness({
+    cwd,
+    sources: {
+      ...govSources,
+      ...secretsSources
+    }
+  });
+  const govGate = scannerGates.govulncheck;
+  const gitleaksGate = scannerGates.gitleaks;
+  const trivySecretsGate = scannerGates["trivy-secrets"];
+  const govDelivery = govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx);
+  for (const [store, count] of Object.entries(govDelivery.dispositionSuppressed ?? {})) {
+    recordDispositionSuppressed(store, count);
+  }
+  advisoryParts.push(...govDelivery.advisoryParts ?? []);
+  const secretsDelivery = secretsLane.render(secretsLane.gate({
+    gitleaks: gitleaksGate,
+    "trivy-secrets": trivySecretsGate
+  }, laneCtx), laneCtx);
+  for (const [store, count] of Object.entries(secretsDelivery.dispositionSuppressed ?? {})) {
+    recordDispositionSuppressed(store, count);
+  }
+  const secretBlockedLocations = secretsDelivery.deliveredLocationKeys ?? new Set;
+  blockerParts.push(...secretsDelivery.blockerParts ?? []);
+  staleSecretParts.push(...secretsDelivery.staleSecretParts ?? []);
+  const trivyAgeLabel = formatCacheAgeLabel(trivyCacheEntry?.data?.scannedAt);
+  const trivyFindingsFiltered = filterFindingsByDisposition(trivyCacheEntry?.data?.findings ?? [], cwd, (f) => trivyFindingToProjectDiagnostic(cwd, f));
+  recordDispositionSuppressed("trivy", trivyFindingsFiltered.suppressed);
+  if (trivyFindingsFiltered.kept.length) {
+    const all = trivyFindingsFiltered.kept;
+    const critical = all.filter((f) => f.severity === "CRITICAL");
+    const advisory = all.filter((f) => f.severity !== "CRITICAL");
+    const fmt = (f) => {
+      const pkg = f.installedVersion ? `${f.pkgName}@${f.installedVersion}` : f.pkgName;
+      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
+      return `  ${f.vulnerabilityId} (${pkg})${fix}
+`;
+    };
+    if (critical.length) {
+      const shown = critical.slice(0, 5);
+      let report = `\uD83D\uDD34 STOP — CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}). Upgrade before shipping:
+`;
+      for (const f of shown)
+        report += fmt(f);
+      if (critical.length > shown.length) {
+        report += `  … and ${critical.length - shown.length} more
+`;
+      }
+      blockerParts.push(report);
+    }
+    if (advisory.length) {
+      const shown = advisory.slice(0, 5);
+      let report = `\uD83D\uDEE1️ Dependency CVEs (trivy, ${trivyAgeLabel}) — upgrade where possible:
+`;
+      for (const f of shown)
+        report += fmt(f);
+      if (advisory.length > shown.length) {
+        report += `  … and ${advisory.length - shown.length} more
+`;
+      }
+      advisoryParts.push(report);
+    }
+  }
+  const licenses = trivyCacheEntry?.data?.licenses ?? [];
+  if (licenses.length) {
+    const shown = licenses.slice(0, 5);
+    let report = `\uD83D\uDCDC Dependency license risk (trivy, ${trivyAgeLabel}) — review for compliance:
+`;
+    for (const l of shown) {
+      const cat = l.category ? `, ${l.category}` : "";
+      report += `  ${l.pkgName} — ${l.license} (${l.severity}${cat})
+`;
+    }
+    if (licenses.length > shown.length) {
+      report += `  … and ${licenses.length - shown.length} more
+`;
+    }
+    advisoryParts.push(report);
+  }
+  if (dispositionSuppressedTotal > 0) {
+    const byLane = Object.entries(dispositionSuppressedByLane).map(([lane, count]) => `${lane} ${count}`).join(", ");
+    advisoryParts.push(`suppressed by disposition: ${dispositionSuppressedTotal} finding(s) ` + `dropped from this turn's gitleaks/govulncheck/trivy sections (${byLane}) ` + "(marked false-positive or won't-fix).");
+  }
+  const t3 = Date.now();
+  let madgeStats;
+  if (getFlag("lens-turn-end-madge") && await depChecker.ensureAvailable()) {
+    const madgeFiles = cacheManager.getFilesForMadge(cwd);
+    if (madgeFiles.length > 0) {
+      dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
+      const absFiles = madgeFiles.map((file) => path.resolve(cwd, file));
+      const batch = await depChecker.checkFilesBatch(absFiles, cwd);
+      const depResults = batch.results;
+      madgeStats = batch.stats;
+      for (const file of madgeFiles) {
+        const absPath = path.resolve(cwd, file);
+        const depResult = depResults.get(absPath);
+        if (!depResult)
+          continue;
+        if (depResult.hasCircular && depResult.circular.length > 0) {
+          dbg(`turn_end: circular dependency note for ${file} (suppressed in blockers-only mode)`);
+        }
+      }
+    }
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "madge",
+    durationMs: Date.now() - t3,
+    metadata: madgeStats ?? { skipped: true }
+  });
+  if (!getFlag("no-tests") && files.length > 0) {
+    const seen = new Set;
+    const targets = [];
+    const candidates = [];
+    const seenCandidateKeys = new Set;
+    for (const file of files) {
+      const abs = resolveRunnerPath(cwd, file);
+      const key = normalizeMapKey(abs);
+      if (seenCandidateKeys.has(key))
+        continue;
+      seenCandidateKeys.add(key);
+      candidates.push({ display: file, abs, isNeighbor: false });
+    }
+    for (const result of cascadeResults) {
+      for (const neighbor of result.neighbors) {
+        const abs = path.isAbsolute(neighbor.filePath) ? neighbor.filePath : resolveRunnerPath(cwd, neighbor.filePath);
+        const key = normalizeMapKey(abs);
+        if (seenCandidateKeys.has(key))
+          continue;
+        seenCandidateKeys.add(key);
+        candidates.push({ display: neighbor.filePath, abs, isNeighbor: true });
+      }
+    }
+    const priorTestCache = cacheManager.readCache("test-runner-findings", cwd)?.data;
+    const carriedDeferred = priorTestCache?.deferredTargets ?? [];
+    const turnSessionId = sessionId ?? runtime.telemetrySessionId;
+    const isThisSession = (entry) => entry.sessionId === turnSessionId;
+    const entryPathKey = (entry) => normalizeMapKey(path.resolve(cwd, entry.testFile));
+    const retiredCarry = (priorTestCache?.retiredTargets ?? []).filter(isThisSession);
+    const retiredKeys = new Set(retiredCarry.map(entryPathKey));
+    const resolvedDeferralKeys = new Set;
+    const heldDeferred = [];
+    const boundPersisted = (entries, label) => {
+      const ordered = [
+        ...entries.filter((entry) => !isThisSession(entry)),
+        ...entries.filter(isThisSession)
+      ];
+      if (ordered.length <= TEST_RUNNER_MAX_PERSISTED_TARGETS)
+        return ordered;
+      dbg(`turn_end: ${label} test target list held ${ordered.length} entries, bounded to the newest ${TEST_RUNNER_MAX_PERSISTED_TARGETS} (oldest foreign-session rows dropped)`);
+      return ordered.slice(-TEST_RUNNER_MAX_PERSISTED_TARGETS);
+    };
+    const writeTestFindings = (record, ownDeferred) => {
+      const live = cacheManager.readCache("test-runner-findings", cwd)?.data;
+      const own = mergeDeferredTargets(heldDeferred, ownDeferred);
+      const ownKeys = new Set(own.map(entryPathKey));
+      const merged = mergeDeferredTargets(live?.deferredTargets ?? [], own).filter((entry) => {
+        if (!isThisSession(entry))
+          return true;
+        const key = entryPathKey(entry);
+        return !resolvedDeferralKeys.has(key) || ownKeys.has(key);
+      });
+      cacheManager.writeCache("test-runner-findings", {
+        ...record,
+        deferredTargets: boundPersisted(merged, "deferred"),
+        retiredTargets: boundPersisted(mergeDeferredTargets(live?.retiredTargets ?? [], retiredCarry), "retired")
+      }, cwd);
+    };
+    let deadDeferred = 0;
+    let heldOverCap = 0;
+    let foreignDeferred = 0;
+    let redispatchedDeferred = 0;
+    let retiredThisTurn = 0;
+    for (const carried of carriedDeferred) {
+      const testFile = path.resolve(cwd, carried.testFile);
+      const carriedKey = normalizeMapKey(testFile);
+      if (!isThisSession(carried)) {
+        foreignDeferred++;
+        continue;
+      }
+      if (seen.has(carriedKey)) {
+        resolvedDeferralKeys.add(carriedKey);
+        continue;
+      }
+      const attempts = carried.attempts ?? 0;
+      if (attempts >= TEST_RUNNER_MAX_DEFERRALS) {
+        resolvedDeferralKeys.add(carriedKey);
+        if (!retiredKeys.has(carriedKey)) {
+          retiredKeys.add(carriedKey);
+          retiredThisTurn++;
+          retiredCarry.push({
+            testFile,
+            runner: carried.runner,
+            attempts,
+            sessionId: turnSessionId
+          });
+          incrementDegradationCount({
+            kind: "test-runner-batch-capped",
+            subject: `${cwd}:deferral-exhausted`,
+            reason: `test target ${path.relative(cwd, testFile)} was cut at the turn-end batch budget ${attempts} turn(s) running and is retired from turn-end selection for the rest of this session — too slow for a per-turn batch, run it explicitly`
+          });
+          dbg(`turn_end: retiring deferred test target ${path.relative(cwd, testFile)} after ${attempts} cut batch(es) — too slow for the turn-end budget, run it explicitly`);
+        }
+        continue;
+      }
+      const config = RUNNERS[carried.runner];
+      if (!config || isExcludedTestTarget(testFile, cwd) || !fs.existsSync(testFile)) {
+        resolvedDeferralKeys.add(carriedKey);
+        deadDeferred++;
+        continue;
+      }
+      if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
+        heldOverCap++;
+        heldDeferred.push({
+          testFile,
+          runner: carried.runner,
+          sourceFile: carried.sourceFile ?? testFile,
+          attempts,
+          sessionId: turnSessionId
+        });
+        continue;
+      }
+      resolvedDeferralKeys.add(carriedKey);
+      seen.add(carriedKey);
+      redispatchedDeferred++;
+      targets.push({
+        testFile,
+        sourceFile: carried.sourceFile ?? testFile,
+        runner: carried.runner,
+        config,
+        strategy: "deferred",
+        deferralAttempts: attempts
+      });
+      dbg(`turn_end: re-running deferred test target ${path.relative(cwd, testFile)} (${carried.runner}) from the previous turn's cut batch`);
+    }
+    if (deadDeferred > 0) {
+      dbg(`turn_end: dropped ${deadDeferred} deferred test target(s) that no longer resolve (missing file, excluded, or unknown runner)`);
+    }
+    if (heldOverCap > 0) {
+      dbg(`turn_end: held ${heldOverCap} deferred test target(s) over the per-turn cap of ${TEST_RUNNER_MAX_TARGETS} — kept on the deferral list for the next turn, attempts unchanged`);
+    }
+    if (foreignDeferred > 0) {
+      dbg(`turn_end: ignored ${foreignDeferred} deferred test target(s) belonging to another session — left on the record for the session that cut them`);
+    }
+    if (carriedDeferred.length > 0) {
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "test_runner_deferral",
+        durationMs: 0,
+        metadata: {
+          carried: carriedDeferred.length,
+          redispatched: redispatchedDeferred,
+          heldOverCap,
+          retired: retiredThisTurn,
+          dropped: deadDeferred,
+          foreignSession: foreignDeferred,
+          sessionId: turnSessionId
+        }
+      });
+    }
+    let overCapTargets = 0;
+    let missingTargetFiles = 0;
+    let excludedTargets = 0;
+    let retiredSkips = 0;
+    for (const { display, abs, isNeighbor } of candidates) {
+      const target = testRunnerClient.getTestRunTarget(abs, cwd, runtime.turnIndex);
+      const targetKey = target ? normalizeMapKey(target.testFile) : "";
+      if (target && !seen.has(targetKey)) {
+        seen.add(targetKey);
+        if (retiredKeys.has(targetKey)) {
+          retiredSkips++;
+          dbg(`turn_end: ${display} → test target retired earlier this session (outran the turn-end batch budget), skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (isExcludedTestTarget(target.testFile, cwd)) {
+          excludedTargets++;
+          dbg(`turn_end: ${display} → test target excluded (integration/e2e), skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (!fs.existsSync(target.testFile)) {
+          missingTargetFiles++;
+          dbg(`turn_end: ${display} → test file missing, skipping spawn (${path.relative(cwd, target.testFile)})`);
+          continue;
+        }
+        if (targets.length >= TEST_RUNNER_MAX_TARGETS) {
+          overCapTargets++;
+          continue;
+        }
+        targets.push({ ...target, sourceFile: abs });
+        dbg(`turn_end: ${display} → test ${target.runner} ${path.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
+      } else if (!target) {
+        dbg(`turn_end: ${display} → no test file found${isNeighbor ? " (cascade-neighbor)" : ""}`);
+      }
+    }
+    if (excludedTargets > 0) {
+      dbg(`turn_end: excluded ${excludedTargets} test target(s) under the built-in integration/e2e exclusion list`);
+    }
+    if (retiredSkips > 0) {
+      dbg(`turn_end: skipped ${retiredSkips} test target(s) retired earlier this session for outrunning the turn-end batch budget`);
+    }
+    if (missingTargetFiles > 0) {
+      dbg(`turn_end: skipped ${missingTargetFiles} test target(s) whose file no longer exists`);
+    }
+    if (overCapTargets > 0) {
+      recordDegradationOnce({
+        kind: "test-runner-batch-capped",
+        subject: cwd,
+        reason: `turn touched more test targets than one turn may fire; ran ${TEST_RUNNER_MAX_TARGETS}, skipped ${overCapTargets} — re-run the remainder with lens_diagnostics or edit them in a smaller batch`
+      });
+      dbg(`turn_end: test target count capped at ${TEST_RUNNER_MAX_TARGETS}, ${overCapTargets} skipped`);
+    }
+    if (targets.length > 0) {
+      for (const target of targets) {
+        target.fileSeqAtRun = runtime.getFileSeq(target.sourceFile);
+      }
+      dbg(`turn_end: firing ${targets.length} test target(s) async (non-blocking, max ${TEST_RUNNER_BATCH_CONCURRENCY} concurrent)`);
+      const firedAtTurn = runtime.turnIndex;
+      const firedSessionId = turnSessionId;
+      const testRunGeneration = (priorTestCache?.testRunGeneration ?? 0) + 1;
+      const provenanceFiles = [
+        ...candidates.map((candidate) => ({
+          path: candidate.abs,
+          role: "source"
+        })),
+        ...targets.map((target) => ({
+          path: target.testFile,
+          role: "test"
+        }))
+      ];
+      const launchedFrom = snapshotAdvisoryProvenance({
+        cwd,
+        runtime,
+        generation: testRunGeneration,
+        files: provenanceFiles
+      });
+      writeTestFindings({
+        ...priorTestCache ?? { content: "" },
+        testRunGeneration
+      }, []);
+      runTestTargetsBounded({
+        targets,
+        concurrency: TEST_RUNNER_BATCH_CONCURRENCY,
+        budgetMs: TEST_RUNNER_BATCH_BUDGET_MS,
+        signal: getAmbientAbortSignal(),
+        run: (t, batchSignal) => testRunnerClient.runTestFileAsync(t.testFile, cwd, {
+          runner: t.runner,
+          config: t.config,
+          turnIndex: firedAtTurn,
+          signal: batchSignal
+        })
+      }).then(({ results, deferred, stopReason }) => {
+        const settledResults = results;
+        const verdicts = settledResults.flatMap((result) => {
+          if (result.status === "rejected")
+            return [];
+          const target = targets.find((candidate) => candidate.testFile === result.value.file);
+          return target ? [
+            {
+              file: result.value.file,
+              sourceFile: target.sourceFile,
+              fileSeq: target.fileSeqAtRun === undefined ? {
+                state: "unknown",
+                reason: "sequence-unavailable"
+              } : {
+                state: "known",
+                value: target.fileSeqAtRun
+              }
+            }
+          ] : [];
+        });
+        const deferredTargets = deferred.map((t) => ({
+          testFile: t.testFile,
+          sourceFile: t.sourceFile,
+          runner: t.runner,
+          attempts: (t.deferralAttempts ?? 0) + 1,
+          sessionId: firedSessionId
+        }));
+        if (deferred.length > 0) {
+          incrementDegradationCount({
+            kind: "test-runner-batch-capped",
+            subject: `${cwd}:${stopReason ?? "incomplete"}`,
+            reason: `test batch stopped early (${stopReason ?? "incomplete"}); ${deferred.length} target(s) killed or never dispatched, deferred to the next turn`
+          });
+          dbg(`turn_end: test batch stopped early (${stopReason ?? "incomplete"}), ${deferred.length} target(s) deferred to the next turn`);
+        }
+        const deferralNote = deferred.length > 0 ? `${deferred.length} test target(s) did not finish within the turn-end batch budget and are deferred to the next turn (they run first): ${deferredTargets.map((t) => path.relative(cwd, t.testFile)).join(", ")}` : "";
+        const supersededByNewerGeneration = (label) => {
+          const current = cacheManager.readCache("test-runner-findings", cwd)?.data;
+          const currentGeneration = current?.testRunGeneration;
+          if (currentGeneration !== undefined && currentGeneration > testRunGeneration) {
+            dbg(`turn_end: ${label}test generation ${testRunGeneration} superseded by ${currentGeneration}`);
+            if (deferredTargets.length > 0) {
+              writeTestFindings({ ...current ?? { content: "" } }, deferredTargets);
+              dbg(`turn_end: ${label}carried ${deferredTargets.length} cut target(s) into the newer generation's deferral set`);
+            }
+            return true;
+          }
+          return false;
+        };
+        const publishedAgainst = snapshotAdvisoryProvenance({
+          cwd,
+          runtime,
+          generation: testRunGeneration,
+          files: provenanceFiles
+        });
+        const superseded = launchedFrom.revision.sessionId !== publishedAgainst.revision.sessionId || launchedFrom.revision.projectSeq !== publishedAgainst.revision.projectSeq || launchedFrom.revision.turnIndex !== publishedAgainst.revision.turnIndex || launchedFrom.files.some((file, index) => publishedAgainst.files[index]?.sha256 !== file.sha256 || publishedAgainst.files[index]?.path !== file.path);
+        const stale = runtime.turnIndex !== firedAtTurn;
+        const failures = [];
+        const resultValues = [];
+        let rejectedCount = 0;
+        let hasRealFailure = false;
+        for (const r of results) {
+          if (r.status === "rejected") {
+            rejectedCount++;
+            emitBounded("test_runner_delivery", `${cwd}:generation:${testRunGeneration}:rejected`, {
+              filePath: cwd,
+              durationMs: 0,
+              metadata: {
+                outcome: "runner-promise-rejected",
+                sessionId: firedSessionId,
+                generation: testRunGeneration,
+                targetCount: targets.length,
+                droppedDetailCount: 0,
+                reason: String(r.reason).slice(0, 500)
+              }
+            }, {
+              ledgerKind: "test-runner-delivery",
+              reason: "test runner promise rejected",
+              capPerTurn: { limit: 8, turnIndex: firedAtTurn }
+            });
+            dbg(`turn_end: test run rejected — ${r.reason}`);
+            continue;
+          }
+          resultValues.push(r.value);
+          const { file, runner, passed, failed, duration, error } = r.value;
+          if (failed > 0)
+            hasRealFailure = true;
+          const shortFile = path.basename(file);
+          const elapsed = formatRunDurationMs(duration);
+          const verdict = failed > 0 ? "FAIL" : "PASS";
+          const summary = isRunnerErrorResult(r.value) ? passed > 0 ? `error: ${error} (${passed} passed before)` : `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
+          dbg(`turn_end: ${stale ? "[stale] " : ""}test ${runner} ${shortFile} → ${summary}`);
+          if (failed > 0 || error) {
+            if (error && String(r.value?.error ?? "").includes("Test file not found")) {
+              continue;
+            }
+            const formatted = testRunnerClient.formatResult(r.value);
+            if (formatted)
+              failures.push(formatted);
+          }
+        }
+        if (rejectedCount > 0) {
+          failures.push(`Test runner rejected ${rejectedCount} promise(s) before producing a structured result.`);
+        }
+        if (failures.length > 0) {
+          if (supersededByNewerGeneration(""))
+            return;
+          const content = [
+            stale ? "[from a prior turn — the edit that triggered this run had already been superseded by the time results came back]" : "",
+            failures.join(`
+
+`),
+            deferralNote
+          ].filter(Boolean).join(`
+
+`);
+          const runnerErrorOnly = !hasRealFailure;
+          writeTestFindings({
+            content,
+            stale,
+            results: resultValues,
+            verdicts,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded,
+            runnerErrorOnly
+          }, deferredTargets);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: true
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+            const cleanFiles = resultValues.filter((value) => value.failed === 0 && !value.error).map((value) => value.file);
+            if (cleanFiles.length > 0) {
+              clearGitGuardTestFailure(cacheManager, cwd, runtime, cleanFiles);
+            }
+            if (!runnerErrorOnly) {
+              mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues.filter((value) => value.failed > 0).map((value) => value.file));
+            } else {
+              emitBounded("test_runner_delivery", `${cwd}:generation:${testRunGeneration}:runner-error-only`, {
+                filePath: cwd,
+                durationMs: 0,
+                metadata: {
+                  outcome: "runner-error-only-not-blocking",
+                  sessionId: firedSessionId,
+                  generation: testRunGeneration,
+                  targetCount: targets.length,
+                  droppedDetailCount: 0
+                }
+              }, {
+                ledgerKind: "test-runner-delivery",
+                reason: "runner-error-only batch kept off the --lens-guard blocker",
+                capPerTurn: { limit: 8, turnIndex: firedAtTurn }
+              });
+            }
+          }
+          dbg(`turn_end: ${failures.length} test failure(s) cached for pull diagnostics and post-agent delivery${stale ? " (stale — turn advanced while tests ran)" : ""}`);
+        } else if (deferred.length > 0) {
+          if (supersededByNewerGeneration("deferred "))
+            return;
+          writeTestFindings({
+            content: deferralNote,
+            stale,
+            results: resultValues,
+            verdicts,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded,
+            runnerErrorOnly: true
+          }, deferredTargets);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: true
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          dbg(`turn_end: partial test batch — ${results.length} target(s) settled, ${deferred.length} deferred to the next turn; NOT recorded as a clean run`);
+        } else if (results.length > 0) {
+          if (supersededByNewerGeneration("clean "))
+            return;
+          writeTestFindings({
+            ...priorTestCache ?? { content: "" },
+            content: "",
+            stale: false,
+            results: resultValues,
+            testRunGeneration,
+            launchedFrom,
+            publishedAgainst,
+            provenance: publishedAgainst,
+            superseded
+          }, []);
+          try {
+            deps.onTestRunnerComplete?.({
+              cwd,
+              sessionId: firedSessionId,
+              generation: testRunGeneration,
+              targetCount: targets.length,
+              hasFindings: false
+            });
+          } catch (deliveryErr) {
+            dbg(`turn_end: test delivery staging failed — ${deliveryErr}`);
+          }
+          if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+            clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues.map((value) => value.file));
+          }
+          dbg(`turn_end: all tests passed${stale ? " (stale — turn advanced while tests ran)" : ""}`);
+        }
+      }).catch(() => {});
+    } else if (carriedDeferred.length > 0) {
+      writeTestFindings({ ...priorTestCache ?? { content: "" } }, []);
+    }
+  }
+  if (runtime.errorDebtBaseline && files.length > 0) {
+    dbg("turn_end: marking error debt check for next session");
+    cacheManager.writeCache("errorDebt", {
+      pendingCheck: true,
+      baselineTestsPassed: runtime.errorDebtBaseline.testsPassed
+    }, cwd);
+  }
+  if (runtime.callGraph && files.length > 0) {
+    const coverage = runtime.callGraph.coverage;
+    if (!coverage || coverage.complete !== true) {
+      advisoryParts.push("Call-graph impact was not emitted because call-graph extraction coverage is incomplete; " + "the affected files may have unreported callers.");
+    } else {
+      const callGraphStart = Date.now();
+      try {
+        const { impact, formatImpact, parseSymbolKey } = await import("./call-graph.js");
+        const { callGraphImpactToProjectDiagnostics } = await import("./project-diagnostics/runner-adapters/call-graph-impact.js");
+        const impactLines = [];
+        let callGraphDispositionSuppressed = 0;
+        const impactFindings = [];
+        for (const filePath of files.slice(0, 5)) {
+          const changedFileKey = normalizeMapKey(resolveRunnerPath(cwd, filePath));
+          const fileCallerKeys = [...runtime.callGraph.callers.keys()].filter((k) => {
+            const graphFilePath = parseSymbolKey(k).filePath;
+            return normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) === changedFileKey;
+          });
+          for (const calleeKey of fileCallerKeys.slice(0, 3)) {
+            const results = impact(runtime.callGraph, calleeKey).filter((r) => {
+              const callerFile = parseSymbolKey(r.symbolKey).filePath;
+              return !callerFile || !isTestRoleCollateral(resolveRunnerPath(cwd, callerFile));
+            });
+            if (results.length > 0) {
+              impactFindings.push({ calleeKey, results });
+              const markable = results.flatMap((result) => callGraphImpactToProjectDiagnostics(cwd, [
+                { calleeKey, results: [result] }
+              ]).map((diagnostic) => ({ result, diagnostic })));
+              const filtered = filterFindingsByDisposition(markable, cwd, (entry) => entry.diagnostic);
+              callGraphDispositionSuppressed += filtered.suppressed;
+              const keptEntries = new Set(filtered.kept);
+              const dropped = new Set(markable.filter((entry) => !keptEntries.has(entry)).map((entry) => entry.result));
+              const survivors = dropped.size === 0 ? results : results.filter((r) => !dropped.has(r));
+              const summary = survivors.length > 0 ? formatImpact(survivors, cwd) : "";
+              if (summary)
+                impactLines.push(`  ${parseSymbolKey(calleeKey).symbolName ?? calleeKey}: ${summary}`);
+            }
+          }
+        }
+        if (impactLines.length > 0) {
+          advisoryParts.push(`\uD83D\uDCCA Call-graph impact (changed symbols have callers):
+${impactLines.join(`
+`)}`);
+        }
+        if (impactFindings.length > 0) {
+          const impactDiagnostics = callGraphImpactToProjectDiagnostics(cwd, impactFindings);
+          if (impactDiagnostics.length > 0) {
+            projectDiagnosticsDelta.push(...impactDiagnostics);
+            projectDiagnosticsSources.add("call-graph");
+          }
+        }
+        if (impactFindings.length > 0 || callGraphDispositionSuppressed > 0) {
+          logLatency({
+            type: "phase",
+            toolName: "turn_end",
+            filePath: cwd,
+            phase: "call_graph_impact",
+            durationMs: Date.now() - callGraphStart,
+            metadata: {
+              callees: impactFindings.length,
+              lines: impactLines.length,
+              dispositionSuppressed: callGraphDispositionSuppressed
+            }
+          });
+        }
+      } catch {}
+    }
+  }
+  if (projectDiagnosticsDelta.length > 0) {
+    writeProjectDiagnosticsDeltaReport(cwd, {
+      version: PROJECT_DIAGNOSTICS_CACHE_VERSION,
+      cwd,
+      generatedAt: new Date().toISOString(),
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq,
+      diagnostics: projectDiagnosticsDelta,
+      sources: [...projectDiagnosticsSources].sort((a, b) => a.localeCompare(b))
+    });
+  }
+  const t4 = Date.now();
+  const modifiedRangesByFile = new Map(Object.entries(turnState.files).map(([file, state]) => [
+    normalizeMapKey(resolveRunnerPath(cwd, file)),
+    state.modifiedRanges
+  ]));
+  const getFileSeq = runtime.getFileSeq;
+  const fileSeqByPath = new Map;
+  if (getFileSeq) {
+    for (const file of files) {
+      const filePath = normalizeMapKey(resolveRunnerPath(cwd, file));
+      fileSeqByPath.set(filePath, getFileSeq.call(runtime, filePath));
+    }
+  }
+  let reverify;
+  if (getFlag("lens-actionable-warnings")) {
+    const persistedReport = cacheManager.readCache("actionable-warnings", cwd, Number.MAX_SAFE_INTEGER)?.data;
+    if (persistedReport?.files?.some((entry) => entry.origin === "deferred")) {
+      const reverifyLspService = getLSPService();
+      if (reverifyLspService) {
+        reverify = await bounded(runPersistentReverify({
+          report: persistedReport,
+          cwd,
+          lspService: reverifyLspService,
+          signal: getAmbientAbortSignal()
+        }), {
+          ms: HOOK_WALL_BUDGET_MS.turn_end,
+          signal: getAmbientAbortSignal(),
+          hook: "turn_end",
+          label: "persistent_reverify"
+        });
+      }
+    }
+    try {
+      const report = await buildActionableWarningsReport({
+        cwd,
+        sessionId: runtime.telemetrySessionId,
+        turnIndex: runtime.turnIndex,
+        files,
+        modifiedRangesByFile,
+        dispatchWarnings: runtime.peekActionableWarnings(),
+        includeLspCodeActions: !!getFlag("lens-actionable-warning-actions"),
+        projectSeqStart: runtime.turnStartProjectSeq,
+        projectSeqEnd: runtime.projectSeq,
+        fileSeqByPath,
+        deltaOnly: !getFlag("lens-actionable-warning-all"),
+        dbg,
+        signal: getAmbientAbortSignal(),
+        onDeferredReport: (deferred) => {
+          try {
+            writeDeferredActionableWarningsReport({
+              cacheManager,
+              cwd,
+              report: deferred,
+              getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime, filePath) : undefined,
+              dbg
+            });
+          } catch (deferErr) {
+            dbg(`turn_end: deferred actionable-warnings write failed — ${deferErr}`);
+          }
+        }
+      });
+      if (reverify?.replacementFiles.length) {
+        const replacementByPath = new Map(reverify.replacementFiles.map((file) => [
+          normalizeMapKey(file.filePath),
+          file
+        ]));
+        const files = (report.files ?? []).map((file) => replacementByPath.get(normalizeMapKey(file.filePath)) ?? file);
+        for (const replacement of reverify.replacementFiles) {
+          if (!files.some((file) => normalizeMapKey(file.filePath) === normalizeMapKey(replacement.filePath))) {
+            files.push(replacement);
+          }
+        }
+        report.files = files;
+      }
+      const publishResult = publishActionableWarningsReport(cacheManager, cwd, report, {
+        origin: "in-band",
+        getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime, filePath) : undefined,
+        dbg
+      });
+      const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd, host, (report) => {
+        let dispositionSuppressed = 0;
+        const files = report.files.map((file) => {
+          const policy = filterFindingsByDisposition(file.warnings, cwd, (warning) => {
+            const { line, column, rule, code } = warning;
+            return {
+              filePath: warning.filePath,
+              severity: warning.severity,
+              semantic: "warning",
+              tool: warning.tool,
+              runner: warning.tool,
+              message: warning.message,
+              source: warning.origin === "lsp" ? "lsp" : "dispatch",
+              ...line === undefined ? {} : { line: warning.line },
+              ...column === undefined ? {} : { column: warning.column },
+              ...rule === undefined ? {} : { rule: warning.rule },
+              ...code === undefined ? {} : { code }
+            };
+          });
+          dispositionSuppressed += policy.suppressed;
+          const kept = policy.kept.filter((warning) => !(isSecretWarning(warning) && typeof warning.line === "number" && secretBlockedLocations.has(secretLocationKey(warning.filePath, warning.line))));
+          return kept.length > 0 ? { ...file, warnings: kept } : undefined;
+        }).filter((file) => file !== undefined);
+        recordDispositionSuppressed("actionable-warnings", dispositionSuppressed);
+        return { files, suppressed: dispositionSuppressed };
+      });
+      if (advisory)
+        advisoryParts.push(advisory);
+      logActionableWarningsEvent({
+        event: advisory ? "advisory_injected" : "advisory_skipped",
+        sessionId: runtime.telemetrySessionId,
+        metadata: {
+          turnIndex: runtime.turnIndex,
+          unsuppressed: publishResult.report.summary.unsuppressed
+        }
+      });
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "actionable_warnings_report",
+        durationMs: Date.now() - t4,
+        metadata: report.summary
+      });
+    } catch (err) {
+      dbg(`turn_end: actionable warning report failed: ${err}`);
+      logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "actionable_warnings_report",
+        durationMs: Date.now() - t4,
+        metadata: {
+          failed: true,
+          error: err instanceof Error ? err.message : String(err)
+        }
+      });
+    }
+  }
+  const t5 = Date.now();
+  try {
+    const qualityWarningsByFile = new Map;
+    for (const warning of runtime.peekCodeQualityWarnings()) {
+      const group = qualityWarningsByFile.get(warning.filePath);
+      if (group)
+        group.push(warning);
+      else
+        qualityWarningsByFile.set(warning.filePath, [warning]);
+    }
+    const qualityWarnings = [];
+    let qualityDispositionSuppressed = 0;
+    for (const [filePath, group] of qualityWarningsByFile) {
+      let content;
+      try {
+        content = fs.readFileSync(filePath, "utf-8");
+      } catch {
+        content = undefined;
+      }
+      const { kept, suppressed } = applyPushedFindingPolicy(group, {
+        cwd,
+        filePath,
+        content
+      });
+      qualityWarnings.push(...kept);
+      qualityDispositionSuppressed += suppressed;
+    }
+    const qualityReport = buildCodeQualityWarningsReport({
+      cwd,
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      warnings: qualityWarnings,
+      modifiedRangesByFile,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq,
+      fileSeqByPath
+    });
+    writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
+    appendCodeQualityWarningsHistory(cwd, qualityReport);
+    const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd, host);
+    if (advisory)
+      advisoryParts.push(advisory);
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "code_quality_warnings_report",
+      durationMs: Date.now() - t5,
+      metadata: {
+        ...qualityReport.summary,
+        dispositionSuppressed: qualityDispositionSuppressed
+      }
+    });
+  } catch (err) {
+    dbg(`turn_end: code quality warning report failed: ${err}`);
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "code_quality_warnings_report",
+      durationMs: Date.now() - t5,
+      metadata: {
+        failed: true,
+        error: err instanceof Error ? err.message : String(err)
+      }
+    });
+  }
+  cacheManager.incrementTurnCycle(cwd, currentOwner);
+  const runnerFindingsStart = Date.now();
+  const pendingRunnerFindings = await drainPendingRunnerFindings(0);
+  let runnerFindingsDelivered = 0;
+  let runnerFindingsStale = 0;
+  let runnerFindingsFailed = 0;
+  let runnerFindingsDropped = 0;
+  let runnerFindingsDispositionSuppressed = 0;
+  const runnerFindingsDeliveredIds = [];
+  for (const pending of pendingRunnerFindings) {
+    const result = pending.result;
+    if (!result)
+      continue;
+    recordRunner(pending.filePath, pending.runnerId, result.status, result.diagnostics.length, Date.now() - pending.markedAtMs, pending.writeIndex);
+    if (result.status === "failed") {
+      runnerFindingsFailed += 1;
+      const detail = result.failureMessage ? `: ${result.failureMessage}` : "";
+      advisoryParts.push(`❌ Deferred runner ${pending.runnerId} failed (${result.failureKind ?? "unknown"})${detail}`);
+      continue;
+    }
+    const findings = result.diagnostics;
+    if (findings.length === 0)
+      continue;
+    const { "late-runner-findings": gate } = gateFindingsByPathFreshness({
+      cwd,
+      sources: {
+        "late-runner-findings": {
+          findings,
+          scannedAt: pending.markedAtMs,
+          citedPath: (finding) => finding.filePath
+        }
+      }
+    });
+    runnerFindingsStale += gate.stale.length;
+    if (gate.stale.length > 0) {
+      dropStaleRunnerFindings(pending);
+      runnerFindingsDropped += 1;
+    }
+    if (gate.live.length === 0)
+      continue;
+    const displayPath = toRunnerDisplayPath(cwd, pending.filePath);
+    let runnerContent;
+    try {
+      runnerContent = fs.readFileSync(pending.filePath, "utf-8");
+    } catch {
+      runnerContent = undefined;
+    }
+    const { kept: runnerKept, suppressed: runnerSuppressedHere } = applyPushedFindingPolicy(gate.live, {
+      cwd,
+      filePath: pending.filePath,
+      content: runnerContent
+    });
+    runnerFindingsDispositionSuppressed += runnerSuppressedHere;
+    if (runnerKept.length === 0) {
+      continue;
+    }
+    const lines = runnerKept.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
+    runnerFindingsDelivered += runnerKept.length;
+    for (const finding of runnerKept) {
+      if (runnerFindingsDeliveredIds.length < 50) {
+        runnerFindingsDeliveredIds.push(finding.id);
+      }
+    }
+    const runnerSuppressedNote = runnerSuppressedHere > 0 ? `; suppressed by disposition: ${runnerSuppressedHere} finding(s)` : "";
+    advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit${runnerSuppressedNote}):
+${lines.join(`
+`)}`);
+  }
+  logLatency({
+    type: "phase",
+    toolName: "turn_end",
+    filePath: cwd,
+    phase: "late_runner_findings",
+    durationMs: Date.now() - runnerFindingsStart,
+    metadata: {
+      pending: pendingRunnerFindings.length,
+      delivered: runnerFindingsDelivered,
+      stale: runnerFindingsStale,
+      failed: runnerFindingsFailed,
+      dropped: runnerFindingsDropped,
+      dispositionSuppressed: runnerFindingsDispositionSuppressed,
+      deliveredIds: runnerFindingsDeliveredIds
+    }
+  });
+  const lateAuxStart = Date.now();
+  const drainedPairs = drainPendingAuxiliaryCoverage();
+  const lateAuxCapEvicted = drainPendingAuxCapEvictedCount();
+  let lateAuxDelivered = 0;
+  let lateAuxStale = 0;
+  let lateAuxMissing = 0;
+  let lateAuxRearmed = 0;
+  let lateAuxClientGone = 0;
+  let lateAuxProbeFailed = 0;
+  let lateAuxCleanConfirmed = 0;
+  let lateAuxExpired = 0;
+  let lateAuxCeilingExhausted = 0;
+  let lateAuxAnswered = 0;
+  let lateAuxNotifyStallDemoted = 0;
+  let lateAuxDispositionSuppressed = 0;
+  let lateAuxAuxSuppressed = 0;
+  const lateAuxCoverageGapPairs = [];
+  let lateAuxCoverageGapDetailCount = 0;
+  let lateAuxCoverageGapDropCount = 0;
+  const lateAuxStuckPairs = [];
+  if (drainedPairs.length > 0) {
+    const lateObserverDeadline = Date.now() + HOOK_WALL_BUDGET_MS.turn_end;
+    const byFile = new Map;
+    for (const pair of drainedPairs) {
+      const list = byFile.get(pair.filePath);
+      if (list)
+        list.push(pair);
+      else
+        byFile.set(pair.filePath, [pair]);
+    }
+    try {
+      const service = getLSPService();
+      for (const [lateAuxPath, pairs] of byFile) {
+        let cached;
+        try {
+          cached = await service.readCachedDiagnosticsForServers(lateAuxPath, new Set(pairs.map((p) => p.serverId)));
+        } catch {
+          lateAuxProbeFailed += pairs.length;
+          for (const pair of pairs) {
+            if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+            } else if (isPendingAuxiliaryPastRearmTtl(pair)) {
+              lateAuxExpired += 1;
+            } else {
+              lateAuxCeilingExhausted += 1;
+            }
+          }
+          continue;
+        }
+        const displayLateAuxPath = toRunnerDisplayPath(cwd, lateAuxPath);
+        let lateAuxContentRead = false;
+        let lateAuxContentValue;
+        const readLateAuxContent = () => {
+          if (!lateAuxContentRead) {
+            lateAuxContentRead = true;
+            try {
+              lateAuxContentValue = fs.readFileSync(lateAuxPath, "utf-8");
+            } catch {
+              lateAuxContentValue = undefined;
+            }
+          }
+          return lateAuxContentValue;
+        };
+        for (const pair of pairs) {
+          const cachedEntry = cached.get(pair.serverId);
+          if (cachedEntry === undefined) {
+            lateAuxClientGone += 1;
+            continue;
+          }
+          if (cachedEntry.notifyStallDemoted) {
+            if (cachedEntry.demotedAt === undefined || pair.markedAtMs > cachedEntry.demotedAt) {
+              lateAuxClientGone += 1;
+              continue;
+            }
+            lateAuxNotifyStallDemoted += 1;
+            const pastTtl = isPendingAuxiliaryPastRearmTtl(pair);
+            const atCeiling = (pair.rearmCount ?? 0) >= MAX_LATE_AUX_REARMS;
+            if (!pastTtl && !atCeiling) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+              if (lateAuxStuckPairs.length < 20)
+                lateAuxStuckPairs.push({
+                  filePath: pair.filePath,
+                  serverId: pair.serverId
+                });
+            } else {
+              if (pastTtl)
+                lateAuxExpired += 1;
+              else
+                lateAuxCeilingExhausted += 1;
+              lateAuxCoverageGapPairs.push({
+                filePath: pair.filePath,
+                serverId: pair.serverId
+              });
+            }
+            continue;
+          }
+          const rawDiags = cachedEntry.diags;
+          if (cachedEntry.publishedAt === undefined || cachedEntry.publishedAt <= pair.markedAtMs) {
+            if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+              rearmPendingAuxiliaryCoverage(pair);
+              lateAuxRearmed += 1;
+              if (lateAuxStuckPairs.length < 20)
+                lateAuxStuckPairs.push({
+                  filePath: pair.filePath,
+                  serverId: pair.serverId
+                });
+            } else {
+              if (isPendingAuxiliaryPastRearmTtl(pair))
+                lateAuxExpired += 1;
+              else
+                lateAuxCeilingExhausted += 1;
+            }
+            continue;
+          }
+          if (typeof service.observeLateAuxiliaryAnswer === "function") {
+            await bounded(service.observeLateAuxiliaryAnswer(lateAuxPath, pair.serverId, cachedEntry.publishedAt - pair.markedAtMs), {
+              ms: Math.max(1, lateObserverDeadline - Date.now()),
+              signal: deps.signal,
+              hook: "turn_end",
+              label: "observeLateAuxiliaryAnswer"
+            });
+          }
+          if (rawDiags.length === 0) {
+            lateAuxCleanConfirmed += 1;
+            continue;
+          }
+          const anchored = rawDiags.filter((d) => d.range?.start?.line !== undefined);
+          if (anchored.length === 0) {
+            lateAuxMissing += rawDiags.length;
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const lateAuxContent = readLateAuxContent();
+          const converted = convertLspDiagnostics(anchored, lateAuxPath);
+          const retained = retagAuxiliaryDiagnostics(converted, anchored, lateAuxContent ?? "", { cwd, fileRole: detectFileRole(lateAuxPath, lateAuxContent) });
+          lateAuxAuxSuppressed += converted.length - retained.length;
+          if (retained.length === 0) {
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const { "late-auxiliary-findings": gate } = gateFindingsByPathFreshness({
+            cwd,
+            sources: {
+              "late-auxiliary-findings": {
+                findings: retained,
+                scannedAt: pair.markedAtMs,
+                citedPath: () => lateAuxPath
+              }
+            }
+          });
+          lateAuxStale += gate.stale.length;
+          lateAuxMissing += retained.length - gate.live.length - gate.stale.length;
+          if (gate.live.length === 0) {
+            if (gate.stale.length > 0) {
+              if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
+                rearmPendingAuxiliaryCoverage(pair, Date.now(), true);
+                lateAuxRearmed += 1;
+              } else if (isPendingAuxiliaryPastRearmTtl(pair)) {
+                lateAuxExpired += 1;
+              } else {
+                lateAuxCeilingExhausted += 1;
+              }
+            } else {
+              lateAuxAnswered += 1;
+            }
+            continue;
+          }
+          const { kept: lateAuxKept, suppressed: lateAuxSuppressedHere } = applyPushedFindingPolicy(gate.live, {
+            cwd,
+            filePath: lateAuxPath,
+            content: lateAuxContent
+          });
+          lateAuxDispositionSuppressed += lateAuxSuppressedHere;
+          if (lateAuxKept.length === 0) {
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const lines = lateAuxKept.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
+          lateAuxDelivered += lateAuxKept.length;
+          lateAuxAnswered += 1;
+          const lateAuxSuppressedNote = lateAuxSuppressedHere > 0 ? `; suppressed by disposition: ${lateAuxSuppressedHere} finding(s)` : "";
+          advisoryParts.push(`\uD83D\uDD50 Late auxiliary diagnostics (${pair.serverId} answered after its grace window${lateAuxSuppressedNote}):
+${lines.join(`
+`)}`);
+        }
+      }
+    } catch (err) {
+      dbg(`turn_end: late-auxiliary probe failed: ${err}`);
+    }
+    for (const pair of lateAuxCoverageGapPairs) {
+      const normalizedPairPath = normalizeMapKey(pair.filePath);
+      const emitted = emitBounded("lsp_scanner_coverage_gap", `${pair.serverId}:${normalizedPairPath}`, {
+        filePath: normalizedPairPath,
+        durationMs: 0,
+        metadata: {
+          source: "late-auxiliary",
+          serverIds: [pair.serverId],
+          reason: "notify-stall-replacement-unavailable",
+          reRaised: true
+        }
+      }, {
+        ledgerKind: "lsp-scanner-coverage-gap",
+        reason: "notify-stall replacement was not available before late-coverage ceiling",
+        capPerTurn: {
+          limit: LATE_AUX_COVERAGE_GAP_DETAIL_CAP_PER_TURN,
+          turnIndex: runtime.turnIndex
+        }
+      });
+      if (emitted)
+        lateAuxCoverageGapDetailCount += 1;
+      else
+        lateAuxCoverageGapDropCount += 1;
+    }
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "late_auxiliary_findings",
+      durationMs: Date.now() - lateAuxStart,
+      metadata: {
+        pending: drainedPairs.length,
+        pairCreated: drainedPairs.length + lateAuxCapEvicted,
+        pendingAfter: pendingAuxiliaryCoverageSize(),
+        delivered: lateAuxDelivered,
+        stale: lateAuxStale,
+        missing: lateAuxMissing,
+        rearmed: lateAuxRearmed,
+        clientGone: lateAuxClientGone,
+        probeFailed: lateAuxProbeFailed,
+        cleanConfirmed: lateAuxCleanConfirmed,
+        expired: lateAuxExpired,
+        ceilingExhausted: lateAuxCeilingExhausted,
+        answered: lateAuxAnswered,
+        dispositionSuppressed: lateAuxDispositionSuppressed,
+        auxSuppressed: lateAuxAuxSuppressed,
+        notifyStallDemoted: lateAuxNotifyStallDemoted,
+        coverageGapReRaised: lateAuxCoverageGapPairs.length,
+        coverageGapReRaisedDetailed: lateAuxCoverageGapDetailCount,
+        coverageGapReRaisedDropped: lateAuxCoverageGapDropCount,
+        capEvicted: lateAuxCapEvicted,
+        stuckPairs: lateAuxStuckPairs
+      }
+    });
+  }
+  const labeledAdvisoryParts = advisoryParts.map((p) => `ℹ️ Advisory — no action required this turn:
+${p}`);
+  const findingParts = [
+    ...blockerParts,
+    ...staleSecretParts,
+    ...labeledAdvisoryParts
+  ];
+  if (findingParts.length > 0) {
+    dbg(`turn_end: ${blockerParts.length} blocker section(s), ${advisoryParts.length} advisory section(s) found, persisting for next context`);
+    const content = capTurnEndMessage(findingParts.join(`
+
+`));
+    const signature = `${files.slice().sort((a, b) => compareOrdinal(a, b)).join("|")}::${content}`;
+    const last = cacheManager.readCache("turn-end-findings-last", cwd);
+    if (last?.data?.signature === signature && last?.data?.sessionId === runtime.telemetrySessionId) {
+      dbg("turn_end: duplicate findings detected (same session), suppressing re-prompt");
+      if (getFlag("lens-guard")) {
+        const existingGuard = cacheManager.readCache("turn-end-findings", cwd)?.data;
+        if (existingGuard) {
+          writeGitGuardRecord(cacheManager, runtime, cwd, {
+            ...existingGuard,
+            content,
+            blockerContent: blockerParts.length > 0 ? capTurnEndMessage(blockerParts.join(`
+
+`)) : undefined,
+            hasBlockers: blockerParts.length > 0 || existingGuard.testFailures === true,
+            blockingFiles: blockerParts.length > 0 ? existingGuard.affectedFiles : undefined,
+            projectSeqStart: runtime.turnStartProjectSeq,
+            projectSeqEnd: runtime.projectSeq,
+            fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [
+              normalizeMapKey(path.resolve(filePath)),
+              seq
+            ])),
+            fileContentHashes: {},
+            consumed: false
+          });
+        }
+      }
+      clearOwnedTurnState();
+      runtime.fixedThisTurn.clear();
+      resetFormatService();
+      return;
+    }
+    for (const commit of pendingDependencyDriftDeliveries)
+      commit();
+    const fileSeqByPath = {};
+    for (const [filePath, seq] of runtime.getFileSeqEntries()) {
+      fileSeqByPath[normalizeMapKey(path.resolve(filePath))] = seq;
+    }
+    if (getFlag("lens-guard")) {
+      const existingGuard = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      const blockingContent = blockerParts.length > 0 ? capTurnEndMessage(blockerParts.join(`
+
+`)) : undefined;
+      const affectedFiles = [
+        ...existingGuard?.affectedFiles ?? [],
+        ...files.map((file) => resolveRunnerPath(cwd, file)),
+        ...cascadeResults.flatMap((result) => result.neighbors.filter((neighbor) => neighbor.diagnostics.length > 0).map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath)))
+      ];
+      writeGitGuardRecord(cacheManager, runtime, cwd, {
+        content: [content, existingGuard?.testFailureContent].filter((value) => !!value).join(`
+
+`),
+        blockerContent: blockingContent,
+        blockingFiles: blockerParts.length > 0 ? affectedFiles : undefined,
+        hasBlockers: !!blockingContent || existingGuard?.testFailures === true,
+        affectedFiles,
+        sessionId: runtime.telemetrySessionId,
+        projectSeqStart: runtime.turnStartProjectSeq,
+        projectSeqEnd: runtime.projectSeq,
+        fileSeqByPath,
+        fileContentHashes: {},
+        consumed: false,
+        testFailures: existingGuard?.testFailures,
+        testFailureContent: existingGuard?.testFailureContent,
+        testFailureFiles: existingGuard?.testFailureFiles
+      });
+    } else {
+      const allAffectedFiles = [
+        ...files.map((file) => resolveRunnerPath(cwd, file)),
+        ...cascadeResults.flatMap((result) => result.neighbors.filter((neighbor) => neighbor.diagnostics.length > 0).map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath)))
+      ];
+      const affectedFiles = [...new Set(allAffectedFiles)].slice(0, MAX_ADVISORY_AFFECTED_FILES);
+      const affectedFilesTruncated = new Set(allAffectedFiles).size > affectedFiles.length;
+      cacheManager.writeCache("turn-end-findings", {
+        content,
+        affectedFiles,
+        affectedFilesTruncated,
+        provenance: snapshotAdvisoryProvenance({
+          cwd,
+          runtime,
+          generation: 0,
+          files: affectedFiles.map((file) => ({
+            path: file,
+            role: "affected"
+          })),
+          truncated: affectedFilesTruncated
+        })
+      }, cwd);
+    }
+    cacheManager.writeCache("turn-end-findings-last", {
+      signature,
+      sessionId: runtime.telemetrySessionId,
+      projectSeqStart: runtime.turnStartProjectSeq,
+      projectSeqEnd: runtime.projectSeq
+    }, cwd);
+    emitLensTurnFindings({
+      cwd,
+      filePaths: files.map((file) => resolveRunnerPath(cwd, file)),
+      sessionId: runtime.telemetrySessionId,
+      turnIndex: runtime.turnIndex,
+      blockerSections: blockerParts.length,
+      advisorySections: advisoryParts.length,
+      content
+    });
+  }
+  if (blockerParts.length === 0) {
+    clearOwnedTurnState();
+    if (getFlag("lens-guard") && advisoryParts.length === 0 && staleSecretParts.length === 0 && !runtime.gitGuardHasBlockers) {
+      const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
+      if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {
+        cacheManager.clearCache("turn-end-findings", cwd);
+      }
+    }
+  }
+  runtime.fixedThisTurn.clear();
+  runtime.clearActionableWarnings();
+  runtime.clearCodeQualityWarnings();
+  if (demotedFindingsRetired > 0) {
+    cacheManager.clearCache("turn-end-findings-last", cwd);
+  }
+  logLatency({
+    type: "tool_result",
+    toolName: "turn_end",
+    filePath: cwd,
+    durationMs: Date.now() - turnEndStart,
+    result: blockerParts.length > 0 ? "blockers_found" : staleSecretParts.length > 0 ? "stale_secrets_pending" : "clean",
+    metadata: {
+      fileCount: files.length,
+      blockerSections: blockerParts.length,
+      staleSecretSections: staleSecretParts.length,
+      advisorySections: advisoryParts.length,
+      demotedFindingsRetired,
+      widgetDemotedFindingsRetired
+    }
+  });
+  resetFormatService();
+}