@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/tools/lens-diagnostics.js

@@ -13,24 +13,35 @@ import {
 } from "../clients/diagnostic-dispositions.js";
 import { DEPENDENCY_DRIFT_MAX_DELIVERIES } from "../clients/blocker-freshness.js";
 import { freshnessFromMtime } from "../clients/freshness.js";
-import { applyInlineSuppressions } from "../clients/dispatch/inline-suppressions.js";
+import {
+  applyFindingPolicy,
+  loadProjectRulePolicyMap
+} from "../clients/dispatch/finding-policy.js";
 import { gateFindingsByPathFreshness } from "../clients/advisory-provenance.js";
+import {
+  formatCacheAgeLabel,
+  markUnreconciledFindings
+} from "../clients/finding-delivery-gate.js";
 import { normalizeRuleId } from "../clients/dispatch/rule-id-normalize.js";
 import {
-  applyRulePolicy,
-  rulePolicyMapFromConfig
+  applyRulePolicy
 } from "../clients/dispatch/rule-policy.js";
-import { loadDmLensProjectConfig } from "../clients/project-lens-config.js";
 import { compactRenderResult } from "./render-compact.js";
 import { combineAbortSignals } from "../clients/deadline-utils.js";
 import { getProjectIgnoreMatcher } from "../clients/file-utils.js";
 import {
   isAtOrAboveHomeDir,
   normalizeEphemeralMapKey,
-  normalizeFilePath
+  normalizeFilePath,
+  normalizeMapKey,
+  realpathOrResolve
 } from "../clients/path-utils.js";
 import { getLSPService } from "../clients/lsp/index.js";
-import { primaryServerId } from "../clients/lsp/config.js";
+import { retireInlineBlockerAndResyncGuard } from "../clients/git-guard.js";
+import {
+  primaryServerId,
+  resolveLspCwdForFile
+} from "../clients/lsp/config.js";
 import { getFullScanWallClockMs } from "../clients/lsp/workspace-sweep-hold.js";
 import { demoteInferredProjectSweepResults } from "../clients/lsp/inferred-project.js";
 import {
@@ -51,6 +62,9 @@ import {
   fetchFreshProjectDiagnostics
 } from "../clients/project-diagnostics/fresh-fetch.js";
 import { loadBootstrapClients } from "../clients/bootstrap.js";
+import {
+  resolveLensToolName
+} from "../clients/tool-config.js";
 import {
   generatedSkipNotice,
   scanTruncationNotice
@@ -65,20 +79,36 @@ import {
   reconcileStaleWidgetFiles,
   widgetDiagnosticUri
 } from "../clients/widget-state.js";
-import { logLatency } from "../clients/latency-logger.js";
+import {
+  claimPhaseOncePerSession,
+  logLatency
+} from "../clients/latency-logger.js";
+import { logExtension } from "../clients/extension-log.js";
+import { recordDegradationOnce } from "../clients/degradation-ledger.js";
 import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
-import { retagAuxiliaryDiagnostics } from "../clients/dispatch/auxiliary-lsp.js";
+import {
+  findAuxiliaryProfileForSource,
+  retagAuxiliaryDiagnostics
+} from "../clients/dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../clients/file-role.js";
 import { STALE_LINE_MARKER } from "../clients/stale-marker.js";
 import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
+import {
+  createLspDiagnosticsTool,
+  LSP_SEVERITY_FILTERS,
+  MAX_BATCH_FILES,
+  renderBatchOutcomeLines
+} from "./lsp-diagnostics.js";
 import {
   demotePastEofDiagnostics,
   PAST_EOF_STALE_MARKER,
   resyncDocumentOnPastEof
 } from "../clients/diagnostic-line-freshness.js";
 const MAX_DIAGNOSTICS_PER_FILE = 50;
-const MAX_PATHS_ENTRIES = 200;
-const NOT_REQUESTED_REASON = "refreshRunners not requested this call (quick mode) — pass refreshRunners=cheap/all/cached to lens_diagnostics mode=full to run it";
+const MAX_PATHS_ENTRIES = MAX_BATCH_FILES;
+function notRequestedReason(host) {
+  return "refreshRunners not requested this call (quick mode) — pass " + `refreshRunners=cheap/all/cached to ${resolveLensToolName("lens_diagnostics", host) ?? "diagnostics"} mode=full to run it`;
+}
 const FULL_SCAN_WALL_CLOCK_MS = getFullScanWallClockMs();
 const FULL_SCAN_BINDING_YIELD_EVERY = 16;
 async function findFullScanBindingMismatches(results) {
@@ -103,21 +133,61 @@ async function findFullScanBindingMismatches(results) {
   }
   return mismatched;
 }
-export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService = getLSPService, flushPending = async () => {}, nextWriteIndex, captureLspStatusRepaint, getRuntime) {
+export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService = getLSPService, flushPending = async () => {}, nextWriteIndex, captureLspStatusRepaint, getRuntime, isLensGuardEnabled = () => true) {
+  const lspProbe = createLspDiagnosticsTool(nextWriteIndex, (info) => {
+    const runtime = getRuntime?.();
+    if (!runtime)
+      return;
+    const retired = retireInlineBlockerAndResyncGuard({
+      runtime,
+      cacheManager,
+      cwd: info.cwd,
+      filePath: info.filePath,
+      ...info.writeIndex === undefined ? {} : { writeIndex: info.writeIndex },
+      coveredSources: info.coveredSources,
+      lensGuardEnabled: isLensGuardEnabled()
+    });
+    if (retired) {
+      logExtension({
+        subsystem: "git-guard",
+        level: "debug",
+        message: `inline_blocker: retired for ${info.filePath}`
+      });
+    }
+  }, getLspService);
   return {
     name: "lens_diagnostics",
     label: "Project Diagnostics",
-    description: "Query dm-lens's diagnostic state. mode=delta/all are cache-only and instant; " + `mode=full is an expensive active project-wide LSP scan merged with cached runner state.
-
-` + "IMPORTANT: unlike lsp_diagnostics (LSP only), this tool covers ALL dispatch " + "runners: LSP errors, tree-sitter structural rules, ast-grep security rules, " + `biome/ruff/eslint lint findings, complexity violations, and more.
-
-` + "mode=delta (default): all warnings for the current agent turn — fixable warnings " + "(actionable-warnings cache) AND code quality/style/complexity issues " + `(code-quality-warnings cache). Same scope as the turn-end advisory, current turn only.
-
-` + "mode=all: blocking errors and warnings — with the actual messages (line, rule, " + "text), not just counts — for every file the agent has " + "EDITED this session (files that went through the dispatch pipeline). " + "NOTE: unedited files with pre-existing errors do NOT appear here — this is " + "not a full project scan. Use before declaring work done; stale blocking " + `errors from earlier turns are visible even if they dropped from turn-end context.
-
-` + "mode=full: EXPENSIVE active scan. Runs project-wide LSP diagnostics for " + "all supported files (including unedited files), then merges/deduplicates " + "that with mode=all cached runner state. Optional refreshRunners=cheap/all/cached " + "folds in project-wide runner findings: the in-process scanners (tree-sitter + " + "fact-rules + ast-grep) plus a FRESH run of the heavyweight analyzers — knip, " + "jscpd (copy-paste), madge (circular deps), gitleaks (secrets), govulncheck/trivy " + "(CVEs), dead-code — rather than a possibly-stale session_start cache; each " + "analyzer de-dupes against a concurrent background run of itself, so this can't " + "double-spawn. Bounded by the slowest analyzer (trivy's own ~180s ceiling).",
-    promptSnippet: "Use lens_diagnostics mode=all to verify no blocking errors remain; use mode=full for expensive project-wide checks",
+    description: 'Query dm-lens diagnostics from the session cache or an active LSP probe, at paths or workspace scope. Empty cache is not proof of clean; probe changed paths when findings are absent or stale. Example: `{source: "lsp", scope: "paths", paths: ["src/app.ts"]}`.',
+    promptSnippet: "lens_diagnostics source=session reads the session cache and an empty cache is not proof of a clean file; use source=lsp scope=paths for changed files when cached findings are absent or stale",
     renderResult: compactRenderResult(({ details, args, isError, text }) => {
+      if (details?.source === "lsp") {
+        const count = details.totalDiagnostics ?? 0;
+        const files = details.filesChecked ?? details.filesScanned ?? 0;
+        const noun = count === 1 ? "diagnostic" : "diagnostics";
+        const filePath = typeof details?.filePath === "string" ? details.filePath : Array.isArray(args?.paths) && args.paths.length === 1 && typeof args.paths[0] === "string" ? args.paths[0] : undefined;
+        const singleFile = (details?.mode === "file" || files === 1) && typeof filePath === "string" ? ` ${path.basename(filePath)}` : "";
+        const scope = files > 1 ? ` across ${files} files` : singleFile;
+        if (isError)
+          return `lens_diagnostics lsp — ${text.split(`
+`)[0] ?? "error"}`;
+        if ((details.navigationOnlyFiles ?? 0) > 0)
+          return `lens_diagnostics${scope} — ${count} ${noun} · ${details.cleanFiles ?? 0} clean · ${details.navigationOnlyFiles} navigation-only`;
+        if ((details.unconfirmedFiles ?? 0) > 0)
+          return `lens_diagnostics${scope} — ${count} ${noun} · ${details.cleanFiles ?? 0} clean · ${details.unconfirmedFiles} unconfirmed${details.timedOutFiles ? ` (${details.timedOutFiles} timed out)` : ""}`;
+        const outcomeCounts = details.outcomeCounts;
+        const tooLargeLines = renderBatchOutcomeLines(details.outcomes ?? []);
+        if (tooLargeLines.length > 0)
+          return `lens_diagnostics${scope} — too large: ${tooLargeLines.join("; ")}`;
+        const notConfirmed = outcomeCounts ? (outcomeCounts.inconclusive ?? 0) + (outcomeCounts.unavailable ?? 0) + (outcomeCounts.unsupported ?? 0) + (outcomeCounts.failed ?? 0) + (outcomeCounts.too_large ?? 0) : 0;
+        if (notConfirmed > 0)
+          return `lens_diagnostics${scope} — ${count} ${noun} · ${notConfirmed} checks not confirmed`;
+        if ((details.incompleteFiles ?? 0) > 0)
+          return `lens_diagnostics${scope} — incomplete (${details.incompleteFiles} files not confirmed)`;
+        if (count === 0 && details.unconfirmed)
+          return details.timedOut ? `lens_diagnostics${scope} — timed out (result may be incomplete)` : `lens_diagnostics${scope} — unconfirmed (server cannot confirm clean)`;
+        return `lens_diagnostics${scope} — ${count} ${noun}`;
+      }
       const scanning = scanningSummaryLine(details, text);
       if (scanning)
         return scanning;
@@ -152,35 +222,101 @@ export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService =
       return `lens_diagnostics ${mode} — ${parts.join(" · ")} (${files} files)${coldSuffix}${failedSuffix}`;
     }),
     parameters: Type.Object({
+      source: Type.Optional(Type.String({
+        enum: ["session", "lsp"],
+        description: "Evidence source: session cache (empty cache is not proof of a " + "clean file — use source=lsp for changed files) or an active LSP probe."
+      })),
+      scope: Type.Optional(Type.String({
+        enum: ["paths", "workspace"],
+        description: "Coverage scope: explicit paths, or workspace (default: current turn's delta for source=session)."
+      })),
       mode: Type.Optional(Type.String({
         enum: ["delta", "all", "full"],
-        description: "delta = current turn's fixable warnings (default). " + "all = session diagnostics for edited/dispatched files. " + "full = expensive active project-wide LSP scan plus cached runner diagnostics."
+        description: "delta = current turn; all = cache-only; full = active LSP scan of paths. Empty cache is not proof of clean."
+      })),
+      path: Type.Optional(Type.String({
+        description: "One file or directory for source=lsp checks."
+      })),
+      concurrency: Type.Optional(Type.Number({
+        description: "Source=lsp batch concurrency (maximum 16)."
+      })),
+      waitMs: Type.Optional(Type.Number({
+        description: "Source=lsp per-file wait budget in milliseconds."
+      })),
+      serverScope: Type.Optional(Type.String({
+        enum: ["primary", "all"],
+        description: "Source=lsp server coverage: primary or all."
       })),
       refreshRunners: Type.Optional(Type.Union([
         Type.Boolean(),
         Type.String({ enum: ["cached", "cheap", "all", "none"] })
       ], {
-        description: "mode=full only: false/none = LSP + widget state only. cached/cheap/all all now trigger a FRESH run (#585) of the heavyweight project analyzers (knip, jscpd, madge, gitleaks, govulncheck, trivy, dead-code) in parallel — bounded by the slowest one (trivy's own ~180s ceiling) — instead of reading a possibly-stale session_start cache; safe to relaunch since each analyzer de-dupes concurrent runs against the same project root. cheap/all additionally refresh the in-process runners (tree-sitter + fact-rules + ast-grep) first."
+        description: "Analyzer refresh mode for full view."
       })),
       maxProjectFiles: Type.Optional(Type.Number({
-        description: "mode=full refreshRunners=cheap/all only: cap project files scanned by the cheap project runners (tree-sitter + fact-rules + ast-grep). Does NOT bound the LSP sweep — use maxLspFiles for that."
+        description: "Project-file limit for cheap runners."
       })),
       maxLspFiles: Type.Optional(Type.Number({
-        description: "mode=full only: cap the number of files routed through the language server for the project-wide LSP sweep. On large projects (e.g. a Next.js app with thousands of source files) the uncapped sweep can take many minutes; set this to bound it. Default is generous (env DM_LENS_LSP_WORKSPACE_MAX_FILES, else 5000)."
+        description: "File limit for the LSP sweep."
       })),
       includeGenerated: Type.Optional(Type.Boolean({
-        description: "mode=full refreshRunners=cheap/all only (no effect with refreshRunners=cached/none, since no project scan runs to apply it to): scan WITHOUT the generated/artifact NAME-heuristic filter (lockfiles, gen.ts-style names, generated/ dirs, …). Default false. Use when a scan's 'excluded by generated-name heuristics' notice suggests a real file was skipped."
+        description: "Include generated-name paths in full scans."
+      })),
+      analysisRoot: Type.Optional(Type.String({
+        description: "Explicit project directory for heavyweight analyzers; it must exist and resolve strictly below the home directory."
       })),
       severity: Type.Optional(Type.String({
-        enum: ["error", "warning", "all"],
-        description: "Filter by severity (default: all)."
+        enum: [...LSP_SEVERITY_FILTERS],
+        description: "Filter by severity threshold (default: all): error shows errors; warning includes errors and warnings; information includes errors, warnings, and information; hint and all show every known tier."
       })),
       paths: Type.Optional(Type.Array(Type.String(), {
         maxItems: MAX_PATHS_ENTRIES,
-        description: `Restrict any mode to an explicit file/directory list (max ${MAX_PATHS_ENTRIES} entries; ` + "more errors instead of silently truncating). Entries may be relative " + "(resolved against cwd) or absolute, and a directory entry matches all " + 'files under it (e.g. "src/"). mode=delta/all are a pure post-filter ' + "of cached/session state — they can only show findings for files dm-lens " + "has already dispatched, so an unseen file shows nothing (use mode=full " + "for an active scan). mode=full actively scans exactly these paths (LSP " + "sweep + cheap in-process runners); cached heavyweight analyzers " + "(jscpd/madge/gitleaks/knip) and the project snapshot are still post-filtered " + "cache reads, never relaunched. Explicitly-listed files are NOT filtered " + "through the project ignore matcher (matching lsp_diagnostics' paths " + "semantics) — naming a file is assumed to mean it regardless of " + ".gitignore/.dm-lens.json; a directory entry's expansion still honors " + "ignore (and when the list mixes directories and files, mode=full scans " + "via the ignore-filtered walk, so an ignore-excluded file entry is only " + "guaranteed an active scan in a files-only list). Nonexistent entries " + "are skipped (mode=full notes them; useful for git-staged-file wrappers " + "where a deleted-but-staged path can appear)."
+        description: "Files or directories to filter."
       }))
     }),
     async execute(_toolCallId, params, signal, onUpdate, ctx) {
+      const requestedSource = params.source;
+      const requestedScope = params.scope;
+      const legacyMode = params.mode;
+      const source = requestedSource ?? "session";
+      const scope = requestedScope ?? (legacyMode === "delta" || legacyMode === undefined ? source === "lsp" ? "paths" : "delta" : "workspace");
+      const cwd = ctx.cwd ?? getCwd();
+      if (source === "lsp") {
+        const lspParams = { ...params };
+        delete lspParams.source;
+        delete lspParams.scope;
+        const hasExplicitPath = typeof lspParams.path === "string" && lspParams.path.length > 0;
+        const hasExplicitPaths = Array.isArray(lspParams.paths) && lspParams.paths.length > 0;
+        if (scope === "workspace" && !hasExplicitPath && !hasExplicitPaths) {
+          lspParams.path = cwd;
+        }
+        const lspStart = Date.now();
+        const result = await lspProbe.execute(_toolCallId, lspParams, signal, onUpdate, ctx.signal ? { cwd, signal: ctx.signal } : { cwd });
+        logLatency({
+          type: "phase",
+          toolName: "lens_diagnostics",
+          filePath: cwd,
+          phase: "lens_diagnostics_lsp_route",
+          durationMs: Date.now() - lspStart,
+          metadata: {
+            scope,
+            isError: result.isError === true,
+            totalDiagnostics: result.details?.totalDiagnostics ?? 0,
+            cleanFiles: result.details?.cleanFiles ?? 0,
+            unconfirmedFiles: result.details?.unconfirmedFiles ?? 0,
+            timedOutFiles: result.details?.timedOutFiles ?? 0
+          }
+        });
+        return {
+          ...result,
+          isError: result.isError === true,
+          details: { ...result.details, source, scope }
+        };
+      }
+      if (requestedSource !== undefined) {
+        const effectiveMode = legacyMode ?? (scope === "workspace" ? "all" : scope === "paths" ? "all" : "delta");
+        params = { ...params, mode: effectiveMode };
+      }
       const repaintLspStatus = captureLspStatusRepaint?.(ctx);
       const mode = params.mode ?? "delta";
       const severity = params.severity ?? "all";
@@ -189,7 +325,6 @@ export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService =
       const maxProjectFiles = parsePositiveInt(params.maxProjectFiles);
       const maxLspFiles = parsePositiveInt(params.maxLspFiles);
       const includeGenerated = params.includeGenerated === true;
-      const cwd = ctx.cwd ?? getCwd();
       let pathsScope;
       try {
         pathsScope = resolvePathsScope(cwd, params.paths);
@@ -240,7 +375,9 @@ export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService =
           onServerReady: repaintLspStatus,
           pathsScope,
           nextWriteIndex,
-          runtime: getRuntime?.()
+          runtime: getRuntime?.(),
+          analysisRoot: typeof params.analysisRoot === "string" ? params.analysisRoot : undefined,
+          host: ctx.host ?? "pi"
         });
       }
       return formatDeltaMode(cacheManager, cwd, severity, pathsScope);
@@ -253,15 +390,18 @@ function formatProjectDeltaDiagnostic(diagnostic, stale) {
   const where = stale ? STALE_LINE_MARKER : `L${diagnostic.line ?? "?"}`;
   return `  ${marker} ${where}  ${rule}  ${diagnostic.message}`;
 }
-function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includeFile) {
+function appendProjectDiagnosticsDeltaLines(groups, cwd, report, severity, includeFile) {
   const scoped = (report?.diagnostics ?? []).filter((diagnostic) => includeFile(diagnostic.filePath) && matchesSeverity(projectDiagnosticToWidget(diagnostic, diagnostic.filePath), severity));
-  const gated = gateFindingsByPathFreshness({
-    store: "lens-diagnostics-delta-project",
-    findings: scoped,
+  const { "lens-diagnostics-delta-project": gated } = gateFindingsByPathFreshness({
     cwd,
-    scannedAt: report?.generatedAt,
-    citedPath: (d) => d.filePath,
-    onMissing: "drop"
+    sources: {
+      "lens-diagnostics-delta-project": {
+        findings: scoped,
+        scannedAt: report?.generatedAt,
+        citedPath: (d) => d.filePath,
+        onMissing: "drop"
+      }
+    }
   });
   const staleSet = new Set(gated.stale);
   const diagnostics = [...gated.live, ...gated.stale];
@@ -273,11 +413,9 @@ function appendProjectDiagnosticsDeltaLines(lines, cwd, report, severity, includ
     byFile.set(filePath, bucket);
   }
   for (const [filePath, fileDiagnostics] of byFile) {
-    const rel = path.relative(cwd, filePath);
-    if (!lines.includes(rel))
-      lines.push(rel);
+    const group = getDeltaFileGroup(groups, cwd, filePath);
     for (const diagnostic of fileDiagnostics) {
-      lines.push(formatProjectDeltaDiagnostic(diagnostic, staleSet.has(diagnostic)));
+      group.projectLines.push(formatProjectDeltaDiagnostic(diagnostic, staleSet.has(diagnostic)));
     }
   }
   return diagnostics.length;
@@ -337,9 +475,6 @@ function filterDeltaReportDispositions(report, cwd, policyMap) {
     return report;
   return { ...report, diagnostics: policyKept };
 }
-function loadProjectRulePolicyMap(cwd) {
-  return rulePolicyMapFromConfig(loadDmLensProjectConfig(cwd).rules);
-}
 function applyDeltaFreshnessGate(files, cwd, generatedAt) {
   const stamps = new Set(files.map((file) => file.generatedAt ?? generatedAt ?? ""));
   if (stamps.size > 1) {
@@ -366,13 +501,16 @@ function applyDeltaFreshnessGate(files, cwd, generatedAt) {
   }
   if (flat.length === 0)
     return files;
-  const gated = gateFindingsByPathFreshness({
-    store: "lens-diagnostics-delta",
-    findings: flat,
+  const { "lens-diagnostics-delta": gated } = gateFindingsByPathFreshness({
     cwd,
-    scannedAt: effectiveAt,
-    citedPath: (f) => f.filePath,
-    onMissing: "drop"
+    sources: {
+      "lens-diagnostics-delta": {
+        findings: flat,
+        scannedAt: effectiveAt,
+        citedPath: (f) => f.filePath,
+        onMissing: "drop"
+      }
+    }
   });
   const byFile = new Map;
   for (const f of gated.live) {
@@ -382,7 +520,12 @@ function applyDeltaFreshnessGate(files, cwd, generatedAt) {
   }
   for (const f of gated.stale) {
     const arr = byFile.get(f.filePath) ?? [];
-    arr.push({ ...f.warning, stale: true, line: undefined });
+    arr.push({
+      ...f.warning,
+      stale: true,
+      line: undefined,
+      staleAsOf: effectiveAt
+    });
     byFile.set(f.filePath, arr);
   }
   return files.map((file) => ({
@@ -390,15 +533,30 @@ function applyDeltaFreshnessGate(files, cwd, generatedAt) {
     warnings: byFile.get(file.filePath) ?? []
   })).filter((file) => file.warnings.length > 0);
 }
+function getDeltaFileGroup(groups, cwd, filePath) {
+  const rel = path.relative(cwd, filePath);
+  let group = groups.get(rel);
+  if (!group) {
+    group = {
+      rel,
+      actionableLines: [],
+      qualityLines: [],
+      projectLines: [],
+      incomplete: false
+    };
+    groups.set(rel, group);
+  }
+  return group;
+}
 function formatDeltaMode(cacheManager, cwd, severity, pathsScope) {
   const actionableEntry = cacheManager.readCache("actionable-warnings", cwd);
   const qualityEntry = cacheManager.readCache("code-quality-warnings", cwd);
+  const reverifyIncompletePaths = new Set((actionableEntry?.data?.files ?? []).filter((file) => file.reVerifyIncomplete).map((file) => normalizeMapKey(file.filePath)));
   const actionable = actionableEntry?.data;
   const quality = qualityEntry?.data;
   const policyMap = loadProjectRulePolicyMap(cwd);
   const projectDelta = filterDeltaReportDispositions(loadProjectDiagnosticsDeltaReport(cwd), cwd, policyMap);
-  const ignoreFile = createCurrentIgnoreFilter(cwd);
-  const includeFile = (filePath) => ignoreFile(filePath) && (!pathsScope || pathsScope.includeFile(filePath));
+  const includeFile = createScopedFileFilter(cwd, pathsScope);
   const visibleWarningFiles = (files) => (files ?? []).filter((file) => includeFile(file.filePath)).map((file) => ({
     filePath: file.filePath,
     generatedAt: file.generatedAt,
@@ -406,31 +564,67 @@ function formatDeltaMode(cacheManager, cwd, severity, pathsScope) {
   })).filter((file) => file.warnings.length > 0);
   const actionableFiles = applyDeltaFreshnessGate(visibleWarningFiles(actionable?.files), cwd, actionable?.generatedAt);
   const qualityFiles = applyDeltaFreshnessGate(visibleWarningFiles(quality?.files), cwd, quality?.generatedAt);
-  const lines = [];
-  if (severity !== "error") {
-    for (const file of actionableFiles) {
-      const rel = path.relative(cwd, file.filePath);
-      lines.push(`${rel}`);
+  const matchingWarnings = (warnings) => warnings.filter((warning) => matchesRecordSeverity(warning.severity, severity));
+  const filteredActionableFiles = actionableFiles.map((file) => ({
+    ...file,
+    warnings: matchingWarnings(file.warnings)
+  })).filter((file) => file.warnings.length > 0);
+  const filteredQualityFiles = qualityFiles.map((file) => ({
+    ...file,
+    warnings: matchingWarnings(file.warnings)
+  })).filter((file) => file.warnings.length > 0);
+  const groups = new Map;
+  if (filteredActionableFiles.length > 0) {
+    for (const file of filteredActionableFiles) {
+      const group = getDeltaFileGroup(groups, cwd, file.filePath);
       for (const w of file.warnings) {
         const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-        lines.push(`  ⚠ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+        group.actionableLines.push(`  ⚠ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+      }
+      const key = normalizeMapKey(file.filePath);
+      if (reverifyIncompletePaths.has(key))
+        group.incomplete = true;
+      if (!group.staleRow) {
+        const staleWarning = file.warnings.find((w) => w.stale);
+        if (staleWarning)
+          group.staleRow = { staleAsOf: staleWarning.staleAsOf };
       }
     }
   }
-  if (severity !== "error") {
-    for (const file of qualityFiles) {
-      const rel = path.relative(cwd, file.filePath);
-      if (!lines.includes(rel))
-        lines.push(rel);
+  if (filteredQualityFiles.length > 0) {
+    for (const file of filteredQualityFiles) {
+      const group = getDeltaFileGroup(groups, cwd, file.filePath);
       for (const w of file.warnings) {
         const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-        lines.push(`  ℹ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
+        group.qualityLines.push(`  ℹ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
       }
+      const key = normalizeMapKey(file.filePath);
+      if (reverifyIncompletePaths.has(key))
+        group.incomplete = true;
+      if (!group.staleRow) {
+        const staleWarning = file.warnings.find((w) => w.stale);
+        if (staleWarning)
+          group.staleRow = { staleAsOf: staleWarning.staleAsOf };
+      }
+    }
+  }
+  const projectDeltaCount = appendProjectDiagnosticsDeltaLines(groups, cwd, projectDelta, severity, includeFile);
+  const lines = [];
+  for (const group of groups.values()) {
+    lines.push(group.rel);
+    lines.push(...group.actionableLines);
+    lines.push(...group.qualityLines);
+    lines.push(...group.projectLines);
+    if (group.staleRow) {
+      lines.push(`  (${formatCacheAgeLabel(group.staleRow.staleAsOf)})`);
     }
+    if (group.incomplete)
+      lines.push("  (re-verify incomplete)");
   }
-  const projectDeltaCount = appendProjectDiagnosticsDeltaLines(lines, cwd, projectDelta, severity, includeFile);
-  const aw = actionableFiles.reduce((count, file) => count + file.warnings.length, 0);
-  const cq = qualityFiles.reduce((count, file) => count + file.warnings.length, 0);
+  const selectedActionableFiles = filteredActionableFiles;
+  const selectedQualityFiles = filteredQualityFiles;
+  const aw = selectedActionableFiles.reduce((count, file) => count + file.warnings.length, 0);
+  const cq = selectedQualityFiles.reduce((count, file) => count + file.warnings.length, 0);
   if (lines.length === 0) {
     let text = `No ${severity === "all" ? "" : severity + " "}issues in the current turn delta.`;
     const carried = getFileDiagnosticSummaries().filter((f) => includeFile(f.filePath)).map((f) => ({
@@ -497,6 +691,7 @@ function resolvePathsScope(cwd, rawPaths) {
   }
   const fileKeys = new Set(fileEntries.map((f) => normalizeFilePath(f)));
   const dirPrefixes = dirEntries.map((d) => normalizeFilePath(d));
+  const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path.resolve(filePath)));
   const includeFile = (filePath) => {
     const key = normalizeFilePath(path.resolve(filePath));
     if (fileKeys.has(key))
@@ -505,6 +700,7 @@ function resolvePathsScope(cwd, rawPaths) {
   };
   return {
     includeFile,
+    includeExplicitFile,
     missing,
     existingEntries,
     hasDirectoryEntries: dirEntries.length > 0
@@ -526,6 +722,16 @@ function pathsScopeMissingNote(scope) {
 
 ⚠ Skipped ${scope.missing.length} path(s) not found on disk: ${shown.join(", ")}${more}`;
 }
+function createScopedFileFilter(cwd, pathsScope) {
+  const ignoreFile = createCurrentIgnoreFilter(cwd);
+  return (filePath) => {
+    if (!pathsScope)
+      return ignoreFile(filePath);
+    if (!pathsScope.includeFile(filePath))
+      return false;
+    return pathsScope.includeExplicitFile(filePath) || ignoreFile(filePath);
+  };
+}
 function filterProjectDiagnosticsSnapshot(snapshot, includeFile) {
   if (!snapshot)
     return;
@@ -556,10 +762,19 @@ function isErrorLike(d) {
   return d.semantic === "blocking" || d.severity === "error";
 }
 function matchesSeverity(d, severity) {
-  if (severity === "error")
-    return isErrorLike(d);
-  if (severity === "warning")
-    return !isErrorLike(d);
+  return matchesRecordSeverity(isErrorLike(d) ? "error" : d.severity, severity);
+}
+function matchesRecordSeverity(recordSeverity, requested) {
+  if (requested === "all")
+    return true;
+  if (requested === "error")
+    return recordSeverity === "error";
+  if (requested === "warning")
+    return recordSeverity === "error" || recordSeverity === "warning";
+  if (requested === "information")
+    return recordSeverity === "error" || recordSeverity === "warning" || recordSeverity === "info" || recordSeverity === "note" || recordSeverity === "help";
+  if (requested === "hint")
+    return recordSeverity === "error" || recordSeverity === "warning" || recordSeverity === "info" || recordSeverity === "note" || recordSeverity === "help" || recordSeverity === "hint";
   return true;
 }
 function severityRank(d) {
@@ -599,7 +814,7 @@ function lspDiagnosticToWidget(diagnostic) {
     line: diagnostic.range.start.line + 1,
     col: diagnostic.range.start.character + 1,
     rule,
-    tool: "lsp"
+    tool: findAuxiliaryProfileForSource(diagnostic.source)?.tool ?? "lsp"
   };
 }
 function projectDiagnosticToWidget(diagnostic, filePath) {
@@ -618,6 +833,28 @@ function diagnosticDedupKey(filePath, diagnostic) {
   const ruleId = normalizeRuleId(diagnostic.rule ?? diagnostic.tool ?? "");
   return [path.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
 }
+function runnerIdOf(diagnostic) {
+  return diagnostic.tool ?? diagnostic.rule?.split(":", 1)[0] ?? "";
+}
+export function runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeCoverage) {
+  const runnerId = runnerIdOf(diagnostic);
+  const coverage = (authoritativeCoverage ?? []).filter((entry) => entry.runnerId === runnerId);
+  if (coverage.length === 0) {
+    return authoritativeRunnerIds?.has(runnerId) ? "retire" : "keep";
+  }
+  const realFilePath = realpathOrResolve(filePath);
+  for (const entry of coverage) {
+    const root = entry.root;
+    const relative = path.relative(root, realFilePath);
+    const underRoot = relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+    if (!underRoot)
+      continue;
+    if (entry.files.has(realFilePath)) {
+      return "retire";
+    }
+  }
+  return "keep";
+}
 function summarizeDiagnostics(filePath, diagnostics, hasFinalSnapshot) {
   let blocking = 0;
   let errors = 0;
@@ -715,7 +952,7 @@ function tallyLspPrimaryVsAuxiliary(results) {
   for (const result of results) {
     const primaryId = primaryServerId(result.filePath);
     for (const diagnostic of result.diagnostics ?? []) {
-      if (diagnostic.source === primaryId)
+      if (diagnostic.serverId === primaryId)
         primary += 1;
       else
         auxiliary += 1;
@@ -723,15 +960,16 @@ function tallyLspPrimaryVsAuxiliary(results) {
   }
   return { primary, auxiliary };
 }
-export function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projectSnapshot, projectDelta, authoritativeLspFiles) {
+function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage) {
   const byFile = new Map;
   const seen = new Set;
   for (const summary of widgetSummaries) {
     const filePath = path.resolve(summary.filePath);
     if (authoritativeLspFiles?.has(filePath))
       continue;
-    const diagnostics = (summary.diagnostics ?? []).map((d) => ({ ...d }));
-    byFile.set(filePath, { ...summary, filePath, diagnostics });
+    const retained = summary.diagnostics ?? [];
+    const diagnostics = retained.filter((diagnostic) => runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) !== "retire").map((d) => ({ ...d }));
+    byFile.set(filePath, diagnostics.length === retained.length ? { ...summary, filePath, diagnostics } : summarizeDiagnostics(filePath, diagnostics, summary.hasFinalSnapshot ?? true));
     for (const diagnostic of diagnostics) {
       seen.add(diagnosticDedupKey(filePath, diagnostic));
     }
@@ -771,9 +1009,12 @@ async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
       const policyKept = applyRulePolicy(summary.diagnostics, policyMap);
       return policyKept.length === summary.diagnostics.length ? summary : summarizeDiagnostics(summary.filePath, policyKept, summary.hasFinalSnapshot);
     }
-    const inlineKept = applyInlineSuppressions(summary.diagnostics, content);
-    const kept = applyDispositions(inlineKept, cwd, summary.filePath, content);
-    const policyKept = applyRulePolicy(kept, policyMap);
+    const { kept: policyKept } = applyFindingPolicy(summary.diagnostics, {
+      cwd,
+      filePath: summary.filePath,
+      content,
+      policyMap
+    });
     for (const d of policyKept) {
       const { weak } = anchorsForDiagnostic(cwd, summary.filePath, d, content);
       if (getDisposition(cwd, weak)?.disposition === "flagged") {
@@ -828,7 +1069,24 @@ async function getProjectDiagnosticsSnapshotForFullMode(cwd, options) {
   }
   if (shouldUseCachedProjectDiagnostics(options.refreshRunners)) {
     const cached = loadProjectDiagnosticsSnapshot(cwd);
-    return cached ? reconcileProjectDiagnosticsSnapshot(cached).snapshot : undefined;
+    if (!cached)
+      return;
+    const reconciled = reconcileProjectDiagnosticsSnapshot(cached);
+    if (reconciled.staleDropped > 0) {
+      logLatency({
+        type: "phase",
+        toolName: "lens_diagnostics",
+        filePath: cwd,
+        phase: "project_snapshot_rows_retired",
+        durationMs: 0,
+        metadata: {
+          files: reconciled.staleDropped,
+          rows: cached.diagnostics.length - reconciled.snapshot.diagnostics.length,
+          scannedAt: cached.scannedAt
+        }
+      });
+    }
+    return reconciled.snapshot;
   }
   return;
 }
@@ -846,17 +1104,20 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     };
   }
   const { signal, pathsScope, nextWriteIndex } = options;
-  const ignoreFile = createCurrentIgnoreFilter(cwd);
-  const includeFile = (filePath) => ignoreFile(filePath) && (!pathsScope || pathsScope.includeFile(filePath));
+  const host = options.host ?? "pi";
+  const includeFile = createScopedFileFilter(cwd, pathsScope);
   const explicitFiles = pathsScope && !pathsScope.hasDirectoryEntries ? pathsScope.existingEntries : undefined;
   const projectRunnersRequested = shouldIncludeProjectRunners(options.refreshRunners);
   const analyzersPromise = projectRunnersRequested ? loadBootstrapClients().then((clients) => fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, {
-    runtime: options.runtime
+    runtime: options.runtime,
+    analysisRoot: options.analysisRoot
   })) : Promise.resolve({
     diagnostics: [],
     runners: [],
+    analyzed: [],
+    authoritativeCoverage: [],
     cold: [...ANALYZER_IDS],
-    coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, NOT_REQUESTED_REASON])),
+    coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, notRequestedReason(host)])),
     failed: [],
     timings: {}
   });
@@ -875,6 +1136,17 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
     }),
     analyzersPromise
   ]);
+  if (extracted.analysisRootError) {
+    return {
+      content: [{ type: "text", text: extracted.analysisRootError }],
+      isError: true,
+      details: {
+        mode: "full",
+        analysisRootError: extracted.analysisRootError,
+        analysisRootValidation: extracted.analysisRootValidation
+      }
+    };
+  }
   const aborted = signal?.aborted ?? false;
   const lspResults = await demoteInferredProjectSweepResults(rawLspResults.filter((result) => includeFile(result.filePath)), cwd, lspService, signal);
   const mismatchedLspResults = await findFullScanBindingMismatches(lspResults);
@@ -882,18 +1154,39 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
   const fullyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) === 0);
   const partiallyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) > 0);
   const unconfirmedLspResults = lspResults.filter((result) => result.timedOut || result.error || mismatchedLspResults.has(result));
+  const authoritativeLspFiles = new Set;
+  const unreconciledFiles = new Set;
   for (const result of fullyCoveredLspResults) {
     try {
       const diagnostics = convertLspDiagnostics(result.diagnostics, result.filePath, { scanOrigin: "lens_diagnostics_full" });
       const retagged = retagAuxiliaryDiagnostics(diagnostics, result.diagnostics, "", { cwd, fileRole: detectFileRole(result.filePath) });
-      reconcileScanDiagnostics(result.filePath, retagged, true, result.writeIndex ?? nextWriteIndex?.(), result.observedAt);
-    } catch {}
+      const retired = reconcileScanDiagnostics(result.filePath, retagged, true, result.writeIndex ?? nextWriteIndex?.(), result.observedAt);
+      if (retired === true) {
+        authoritativeLspFiles.add(path.resolve(result.filePath));
+      } else {
+        unreconciledFiles.add(path.resolve(result.filePath));
+        recordDegradationOnce({
+          kind: "diagnostic-retained-unreconciled",
+          subject: `${path.resolve(result.filePath)}:lsp`,
+          reason: "confirmed diagnostic result could not replace retained widget state"
+        });
+      }
+    } catch {
+      unreconciledFiles.add(path.resolve(result.filePath));
+      recordDegradationOnce({
+        kind: "diagnostic-retained-unreconciled",
+        subject: `${path.resolve(result.filePath)}:lsp`,
+        reason: "confirmed diagnostic result failed during widget reconciliation"
+      });
+    }
   }
   const policyMap = loadProjectRulePolicyMap(cwd);
   const scannedSnapshot = filterProjectDiagnosticsSnapshot(rawProjectSnapshot, includeFile);
-  const projectSnapshot = applyProjectRulePolicy(foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd), policyMap);
+  const authoritativeRunnerIds = new Set(extracted.analyzed ?? []);
+  const authoritativeRunnerCoverage = extracted.authoritativeCoverage ?? [];
+  const foldedProjectSnapshot = foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd);
+  const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap);
   const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap);
-  const authoritativeLspFiles = new Set(fullyCoveredLspResults.map((result) => path.resolve(result.filePath)));
   const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) && authoritativeLspFiles.has(path.resolve(summary.filePath)) && (summary.diagnostics?.length ?? 0) > 0).length;
   if (authoritativeRetiredCount > 0) {
     logLatency({
@@ -904,13 +1197,59 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
       metadata: { files: authoritativeRetiredCount }
     });
   }
-  const summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles), cwd, policyMap);
+  const retiredRunnerCounts = new Map;
+  const runnerRetiredRows = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)).reduce((total, summary) => total + (summary.diagnostics ?? []).filter((diagnostic) => {
+    const retired = runnerRetirementDecision(diagnostic, summary.filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) === "retire";
+    if (retired) {
+      const runnerId = runnerIdOf(diagnostic);
+      retiredRunnerCounts.set(runnerId, (retiredRunnerCounts.get(runnerId) ?? 0) + 1);
+    }
+    return retired;
+  }).length, 0);
+  if (runnerRetiredRows > 0) {
+    logLatency({
+      type: "phase",
+      phase: "runner_authoritative_widget_retire",
+      filePath: "",
+      durationMs: 0,
+      metadata: {
+        rows: runnerRetiredRows,
+        runners: [...retiredRunnerCounts.keys()].join(","),
+        coverage: authoritativeRunnerCoverage.map((entry) => ({
+          runnerId: entry.runnerId,
+          root: entry.root,
+          files: entry.files.size
+        }))
+      }
+    });
+  }
+  for (const entry of authoritativeRunnerCoverage) {
+    if (entry.files.size === 0)
+      continue;
+    if (!claimPhaseOncePerSession("runner_coverage_retired", entry.runnerId)) {
+      continue;
+    }
+    logLatency({
+      type: "phase",
+      phase: "runner_coverage_retired",
+      filePath: "",
+      durationMs: 0,
+      metadata: {
+        runnerId: entry.runnerId,
+        count: retiredRunnerCounts.get(entry.runnerId) ?? 0
+      }
+    });
+  }
+  let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage), cwd, policyMap);
+  if (unreconciledFiles.size > 0) {
+    summaries = summaries.map((summary) => unreconciledFiles.has(path.resolve(summary.filePath)) ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot) : summary);
+  }
   const parsedProjectScanObservedAt = projectSnapshot?.scannedAt ? Date.parse(projectSnapshot.scannedAt) : undefined;
   const projectScanObservedAt = parsedProjectScanObservedAt !== undefined && Number.isFinite(parsedProjectScanObservedAt) ? parsedProjectScanObservedAt : undefined;
   for (const summary of summaries) {
     reconcileCorrelatedScanDiagnostics(summary.filePath, summary.diagnostics, nextWriteIndex?.(), projectScanObservedAt);
   }
-  const result = formatAllMode(cwd, severity, summaries, {
+  const result = await formatAllMode(cwd, severity, summaries, {
     mode: "full",
     lspFilesChecked: rawLspResults.length,
     partial: aborted,
@@ -925,7 +1264,7 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
       sources: projectDelta.sources,
       turnIndex: projectDelta.turnIndex
     }
-  });
+  }, 0, pathsScope);
   const missingNote = pathsScopeMissingNote(pathsScope);
   const unconfirmedByReason = tallyUnconfirmedReasons(unconfirmedLspResults, mismatchedLspResults);
   const lspServerBreakdown = tallyLspByPrimaryServer(confirmedLspResults, unconfirmedLspResults);
@@ -940,18 +1279,39 @@ async function formatFullMode(cwd, severity, lspService, cacheManager, options =
 
 ⚠ Auxiliary coverage incomplete: ${uncoveredScannerIds.join(", ")} did not answer for ${partiallyCoveredLspResults.length} file(s). Findings from answering servers are included; this is not a clean verdict for the named scanner lane(s).` : "";
   const lspPrimaryVsAuxiliary = tallyLspPrimaryVsAuxiliary(confirmedLspResults);
+  logExtension({
+    subsystem: "lsp-diagnostics",
+    message: "lens_diagnostics verdict",
+    metadata: {
+      server: [
+        ...new Set(confirmedLspResults.map((result) => primaryServerId(result.filePath) ?? "unknown"))
+      ].join(","),
+      primary: lspPrimaryVsAuxiliary.primary,
+      auxiliary: lspPrimaryVsAuxiliary.auxiliary,
+      total: lspPrimaryVsAuxiliary.primary + lspPrimaryVsAuxiliary.auxiliary,
+      sources: [
+        ...new Set(confirmedLspResults.flatMap((result) => (result.diagnostics ?? []).map((diagnostic) => diagnostic.source ?? "unknown")))
+      ].slice(0, 5)
+    }
+  });
   const lspPrimaryVsAuxiliaryNote = lspPrimaryVsAuxiliary.primary + lspPrimaryVsAuxiliary.auxiliary > 0 ? `
 
 LSP sweep findings: ${lspPrimaryVsAuxiliary.primary} primary (language server), ` + `${lspPrimaryVsAuxiliary.auxiliary} auxiliary (ast-grep/opengrep/zizmor/typos/marksman/...).` : "";
   const abortedIds = new Set(extracted.abortedIds ?? []);
   const genuinelyColdIds = extracted.cold.filter((id) => !abortedIds.has(id));
+  const partialIds = extracted.partial ?? [];
   const coldNote = extracted.unsafeRoot ? `
 
-heavyweight analyzers skipped: the working directory resolves at or above the home directory, so a fresh knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code scan would walk every unrelated tree under it. Re-run from inside a project directory. Absence of their findings is NOT a clean verdict.` : !projectRunnersRequested && genuinelyColdIds.length > 0 ? `
+heavyweight analyzers skipped: the analysis root resolves at or above the home directory, so a fresh knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code scan would walk every unrelated tree under it. Supply a project directory below the home ceiling. Absence of their findings is NOT a clean verdict.` : extracted.analysisRootError ? `
 
-not run this call (quick mode): ${genuinelyColdIds.join(", ")}. ${NOT_REQUESTED_REASON}. Absence of their findings is NOT a clean verdict.` : genuinelyColdIds.length > 0 ? `
+heavyweight analyzers skipped: ${extracted.analysisRootError}. Supply an existing project directory below the home ceiling. Absence of their findings is NOT a clean verdict.` : !projectRunnersRequested && genuinelyColdIds.length > 0 ? `
+
+not run this call (quick mode): ${genuinelyColdIds.join(", ")}. ${notRequestedReason(host)}. Absence of their findings is NOT a clean verdict.` : genuinelyColdIds.length > 0 ? `
 
 cold (not applicable / unavailable this run): ${genuinelyColdIds.map((id) => formatNotRunEntry(id, extracted.coldReasons)).join(", ")}. These analyzers have not contributed to this result — absence of their findings is NOT a clean verdict.` : "";
+  const partialNote = partialIds.length > 0 ? `
+
+⚠ partial coverage (findings included): ${partialIds.map((id) => `${id} — ${extracted.partialReasons?.[id] ?? "coverage is incomplete"}`).join(", ")}. Coverage is incomplete, so absence of findings is NOT a clean verdict.` : "";
   const testRunnerEditScopedNote = extracted.runners.includes("test-runner") ? `
 
 test-runner coverage is edit-scoped, NOT a full-project run: its findings only reflect the test file(s) touched by the most recent edit's turn_end fire, not a fresh whole-project test suite run (mode=full never re-runs the suite — see fresh-fetch.ts). Absence of test-runner findings elsewhere in the project is NOT a clean verdict, and presence here does not mean "just checked" — it may be from several turns ago.` : "";
@@ -971,14 +1331,14 @@ project file walk skipped: the working directory resolves at or above the home d
   const scanTruncatedNote = scanTruncatedNoticeText ? `
 
 ${scanTruncatedNoticeText}` : "";
-  const generatedSkipNoticeText = projectSnapshot ? generatedSkipNotice(projectSnapshot) : undefined;
+  const generatedSkipNoticeText = projectSnapshot ? generatedSkipNotice(projectSnapshot, host) : undefined;
   const generatedSkipNote = generatedSkipNoticeText ? `
 
 ${generatedSkipNoticeText}` : "";
   const cheapScanScannedAtMs = rawProjectSnapshot?.scannedAt ? Date.parse(rawProjectSnapshot.scannedAt) : undefined;
   const cheapScanStatusNote = !projectRunnersRequested ? `
 
-cheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${NOT_REQUESTED_REASON}).` : options.refreshRunners === "cached" ? cheapScanScannedAtMs !== undefined && Number.isFinite(cheapScanScannedAtMs) ? `
+cheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${notRequestedReason(host)}).` : options.refreshRunners === "cached" ? cheapScanScannedAtMs !== undefined && Number.isFinite(cheapScanScannedAtMs) ? `
 
 cheap project scan (tree-sitter/fact-rules/ast-grep): served from cache, ${formatCacheAgeOld(Date.now() - cheapScanScannedAtMs)} — not re-run this call.` : `
 
@@ -1002,6 +1362,7 @@ served from cache this call (not re-run): ${cachedAgeEntries.map(([id, ms]) => `
     details: {
       ...result.details,
       coldRunners: extracted.cold,
+      partialRunners: partialIds,
       coldReasons: extracted.coldReasons ?? {},
       failedAnalyzers,
       analyzerTimingsMs: extracted.timings,
@@ -1010,7 +1371,8 @@ served from cache this call (not re-run): ${cachedAgeEntries.map(([id, ms]) => `
       analyzersCachedAgeMs: cachedAgeMs,
       analyzersAborted: extracted.aborted ?? false,
       analyzersAbortedIds: extracted.abortedIds ?? [],
-      analyzersUnsafeRoot: extracted.unsafeRoot ?? false,
+      analyzersUnsafeRoot: extracted.analysisRootValidation?.state === "unsafe" || extracted.unsafeRoot === true,
+      analysisRootValidation: extracted.analysisRootValidation,
       projectWalkUnsafeRoot: walkUnsafeRoot,
       lspFilesConfirmed: confirmedLspResults.length,
       lspFilesUnconfirmed: unconfirmedLspResults.length,
@@ -1039,18 +1401,18 @@ served from cache this call (not re-run): ${cachedAgeEntries.map(([id, ms]) => `
       content: [
         {
           type: "text",
-          text: result.content[0].text + note + unconfirmedLspNote + auxiliaryCoverageNote + lspPrimaryVsAuxiliaryNote + coldNote + testRunnerEditScopedNote + failedNote + dispositionSuppressedNote + walkUnsafeRootNote + scanTruncatedNote + generatedSkipNote + abortedNote + freshNote + cachedAgeNote + cheapScanStatusNote + missingNote
+          text: result.content[0].text + note + unconfirmedLspNote + auxiliaryCoverageNote + lspPrimaryVsAuxiliaryNote + partialNote + coldNote + testRunnerEditScopedNote + failedNote + dispositionSuppressedNote + walkUnsafeRootNote + scanTruncatedNote + generatedSkipNote + abortedNote + freshNote + cachedAgeNote + cheapScanStatusNote + missingNote
         }
       ],
       details: { ...resultWithCold.details, timedOut }
     };
   }
-  if (missingNote || coldNote || testRunnerEditScopedNote || failedNote || dispositionSuppressedNote || walkUnsafeRootNote || scanTruncatedNote || generatedSkipNote || abortedNote || freshNote || cachedAgeNote || cheapScanStatusNote || unconfirmedLspNote || auxiliaryCoverageNote || lspPrimaryVsAuxiliaryNote) {
+  if (missingNote || coldNote || partialNote || testRunnerEditScopedNote || failedNote || dispositionSuppressedNote || walkUnsafeRootNote || scanTruncatedNote || generatedSkipNote || abortedNote || freshNote || cachedAgeNote || cheapScanStatusNote || unconfirmedLspNote || auxiliaryCoverageNote || lspPrimaryVsAuxiliaryNote) {
     return {
       content: [
         {
           type: "text",
-          text: result.content[0].text + unconfirmedLspNote + auxiliaryCoverageNote + lspPrimaryVsAuxiliaryNote + coldNote + testRunnerEditScopedNote + failedNote + dispositionSuppressedNote + walkUnsafeRootNote + scanTruncatedNote + generatedSkipNote + abortedNote + freshNote + cachedAgeNote + cheapScanStatusNote + missingNote
+          text: result.content[0].text + unconfirmedLspNote + auxiliaryCoverageNote + lspPrimaryVsAuxiliaryNote + partialNote + coldNote + testRunnerEditScopedNote + failedNote + dispositionSuppressedNote + walkUnsafeRootNote + scanTruncatedNote + generatedSkipNote + abortedNote + freshNote + cachedAgeNote + cheapScanStatusNote + missingNote
         }
       ],
       details: resultWithCold.details
@@ -1058,12 +1420,19 @@ served from cache this call (not re-run): ${cachedAgeEntries.map(([id, ms]) => `
   }
   return resultWithCold;
 }
-function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(), detailOverrides = { mode: "all" }, staleDropped = 0, pathsScope, dependencyDemoted = 0) {
+async function projectResolvedCwd(summary, cwd) {
+  const resolvedCwd = await resolveLspCwdForFile(summary.filePath, cwd);
+  return {
+    ...summary,
+    ...resolvedCwd === undefined ? {} : { resolvedCwd },
+    diagnostics: summary.diagnostics ?? []
+  };
+}
+async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(), detailOverrides = { mode: "all" }, staleDropped = 0, pathsScope, dependencyDemoted = 0) {
   const footerCapped = summaries.reduce((n, s) => n + (s.diagnostics ?? []).filter((d) => d.footerRetired === true).length, 0);
   const staleNote = (staleDropped > 0 ? ` (${staleDropped} changed file${staleDropped === 1 ? "" : "s"} omitted as stale — use mode=full to rescan)` : "") + (dependencyDemoted > 0 ? ` (${dependencyDemoted} blocking finding${dependencyDemoted === 1 ? "" : "s"} demoted to [stale] — an imported file changed since; re-run to confirm)` : "") + (footerCapped > 0 ? ` (${footerCapped} demoted finding${footerCapped === 1 ? "" : "s"} capped after ${DEPENDENCY_DRIFT_MAX_DELIVERIES} unconfirmed deliveries — no longer shown in the dm-lens footer, still listed here; re-run to confirm)` : "");
   const isFullMode = detailOverrides.mode === "full";
-  const ignoreFile = createCurrentIgnoreFilter(cwd);
-  const includeFile = (filePath) => ignoreFile(filePath) && (!pathsScope || pathsScope.includeFile(filePath));
+  const includeFile = createScopedFileFilter(cwd, pathsScope);
   const policyMap = loadProjectRulePolicyMap(cwd);
   const dispositioned = isFullMode ? summaries : summaries.map((s) => {
     const diagnostics = s.diagnostics ?? [];
@@ -1090,7 +1459,7 @@ function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(),
     if (severity === "error")
       return s.blocking > 0 || s.errors > 0;
     if (severity === "warning")
-      return s.warnings > 0;
+      return s.blocking > 0 || s.errors > 0 || s.warnings > 0;
     return s.blocking > 0 || s.errors > 0 || s.warnings > 0 || s.advisories > 0 || (s.diagnostics ?? []).some((d) => d.stale);
   });
   const pathsNote = isFullMode ? "" : pathsScopeCacheOnlyNote(pathsScope);
@@ -1106,12 +1475,13 @@ function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(),
     };
   }
   const sorted = withIssues.sort((a, b) => b.blocking - a.blocking || b.errors - a.errors || b.warnings - a.warnings);
+  const rendered = await Promise.all(sorted.map((summary) => projectResolvedCwd(summary, cwd)));
   const lines = [];
   let totalBlocking = 0;
   let totalErrors = 0;
   let totalWarnings = 0;
   let totalAdvisories = 0;
-  for (const s of sorted) {
+  for (const s of rendered) {
     const rel = path.relative(cwd, s.filePath);
     const parts = [];
     if (s.blocking > 0)
@@ -1128,6 +1498,8 @@ function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(),
     if (staleCount > 0) {
       parts.push(`${staleCount} stale — re-run to confirm`);
     }
+    if (s.resolvedCwd !== undefined)
+      parts.push(`cwd=${s.resolvedCwd}`);
     lines.push(`${rel}  ${parts.join("  ")}`);
     const matching = (s.diagnostics ?? []).filter((d) => matchesSeverity(d, severity)).sort(bySeverityThenLine);
     const shown = matching.slice(0, MAX_DIAGNOSTICS_PER_FILE);