@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-lens/clients/runtime-turn.js

@@ -16,6 +16,7 @@ import {
 import {
   clearGitGuardTestFailure,
   mergeGitGuardTestFailure,
+  resyncGitGuardAfterInlinePolicy,
   writeGitGuardRecord
 } from "./git-guard.js";
 import { cascadeSettleWaitMs } from "./cascade-budget.js";
@@ -35,14 +36,9 @@ import {
   SWEEP_IDLE_SAFETY_MARGIN_MS
 } from "./lsp/workspace-sweep-hold.js";
 import { isTestRoleCollateral } from "./collateral-test-role.js";
-import {
-  dedupeSecretFindings,
-  fromAstGrepWarnings,
-  fromGitleaks,
-  fromTrivySecrets,
-  isSecretWarning,
-  secretLocationKey
-} from "./secret-findings.js";
+import { isSecretWarning, secretLocationKey } from "./secret-findings.js";
+import { govulncheckLane } from "./turn-end/lanes/govulncheck.js";
+import { secretsLane } from "./turn-end/lanes/secrets.js";
 import {
   deadCodeIssueKey,
   deadCodeIssues,
@@ -55,14 +51,8 @@ import {
   writeProjectDiagnosticsDeltaReport
 } from "./project-diagnostics/cache.js";
 import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
-import { gitleaksFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/gitleaks.js";
-import { govulncheckFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/govulncheck.js";
-import {
-  trivyFindingToProjectDiagnostic,
-  trivySecretFindingToProjectDiagnostic
-} from "./project-diagnostics/runner-adapters/trivy.js";
+import { trivyFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/trivy.js";
 import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
-import { applyDispositionsMultiFile } from "./diagnostic-dispositions.js";
 import { logLatency } from "./latency-logger.js";
 import {
   getLspBudgetIdleTimeoutMs,
@@ -75,6 +65,7 @@ import { isSubagentSession } from "./subagent-mode.js";
 import { formatRunDurationMs } from "./run-duration.js";
 import {
   isExcludedTestTarget,
+  isRunnerErrorResult,
   RUNNERS
 } from "./test-runner-client.js";
 import {
@@ -97,6 +88,20 @@ import {
   pendingAuxiliaryCoverageSize
 } from "./lsp/pending-aux-coverage.js";
 import { convertLspDiagnostics } from "./dispatch/utils/lsp-diagnostics.js";
+import { retagAuxiliaryDiagnostics } from "./dispatch/auxiliary-lsp.js";
+import {
+  runPersistentReverify
+} from "./persistent-reverify.js";
+import { cascadeCarrySuffix } from "./cascade-format.js";
+import {
+  applyPushedFindingPolicy,
+  filterFindingsByDisposition
+} from "./dispatch/finding-policy.js";
+import { detectFileRole } from "./file-role.js";
+import {
+  applyInlineBlockerPolicy,
+  summarizeInlineBlockerPolicy
+} from "./inline-blocker-dispositions.js";
 import {
   drainPendingRunnerFindings,
   dropStaleRunnerFindings,
@@ -116,6 +121,8 @@ import {
 } from "./demoted-finding-render.js";
 import { STALE_LINE_MARKER } from "./stale-marker.js";
 import { getActiveSessionId } from "./session-lifecycle.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
 import {
   drainRenderedDependencyDriftFilePaths,
   getWidgetBlockingFilesForSweep,
@@ -214,17 +221,6 @@ export async function runTestTargetsBounded(args) {
     stopReason
   };
 }
-function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
-  if (findings.length === 0)
-    return { kept: findings, suppressed: 0 };
-  const candidates = findings.map((finding) => ({
-    finding,
-    diagnostic: toDiagnostic(finding)
-  }));
-  const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.diagnostic), cwd, (d) => d.filePath));
-  const kept = candidates.filter((c) => survivors.has(c.diagnostic)).map((c) => c.finding);
-  return { kept, suppressed: findings.length - kept.length };
-}
 function wouldPoisonCache(prev, next) {
   return !next.success && prev?.data.success === true;
 }
@@ -330,10 +326,19 @@ export async function handleTurnEnd(deps) {
     depChecker,
     testRunnerClient,
     sessionId,
+    host = "pi",
     owner,
     resetLSPService,
     resetFormatService
   } = deps;
+  const turnIndexAtDispatch = runtime.turnIndex;
+  const clearOwnedTurnState = () => {
+    if (runtime.turnIndex !== turnIndexAtDispatch) {
+      dbg(`turn_end: retaining newer turn state (dispatch=${turnIndexAtDispatch}, current=${runtime.turnIndex})`);
+      return;
+    }
+    cacheManager.clearTurnState(cwd, currentOwner);
+  };
   updateHeartbeat().catch(() => {});
   const cwd = ctxCwd ?? process.cwd();
   let turnState = cacheManager.readTurnState(cwd);
@@ -355,7 +360,7 @@ export async function handleTurnEnd(deps) {
   }
   if (access === "available" && (turnState.files || turnState.owner || turnState.sessionId)) {
     dbg("turn_end: evicting stale turn-state owner");
-    cacheManager.clearTurnState(cwd, currentOwner);
+    clearOwnedTurnState();
     turnState = cacheManager.readTurnState(cwd);
   }
   const files = Object.keys(turnState.files);
@@ -405,7 +410,7 @@ export async function handleTurnEnd(deps) {
   dbg(`turn_end: ${files.length} file(s) modified, cycles: ${turnState.turnCycles}/${turnState.maxCycles}, access: ${access}, owner: ${gateOwnerLabel}`);
   if (cacheManager.isMaxCyclesExceeded(cwd)) {
     dbg("turn_end: max cycles exceeded, clearing state and forcing through");
-    cacheManager.clearTurnState(cwd, currentOwner);
+    clearOwnedTurnState();
     runtime.fixedThisTurn.clear();
     resetFormatService();
     return;
@@ -432,6 +437,7 @@ export async function handleTurnEnd(deps) {
   });
   const blockerFreshnessStart = Date.now();
   const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+    ...deps.signal === undefined ? {} : { signal: deps.signal },
     additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
       filePath: row.filePath,
       recordedAtMs: row.recordedAtMs,
@@ -449,20 +455,24 @@ export async function handleTurnEnd(deps) {
       kept: blockerFreshness.kept,
       revalidated: blockerFreshness.revalidated,
       alreadyStale: blockerFreshness.alreadyStale,
-      truncatedImports: blockerFreshness.truncatedImports
+      truncatedImports: blockerFreshness.truncatedImports,
+      selfHealed: blockerFreshness.selfHealed,
+      selfUnverifiable: blockerFreshness.selfUnverifiable,
+      hashBudgetExhausted: blockerFreshness.hashBudgetExhausted
     }
   });
   const unresolvedBlockers = runtime.getInlineBlockersSnapshot();
   let demotedFindingsRetired = 0;
   const pendingDependencyDriftDeliveries = [];
-  for (const {
-    filePath: bPath,
-    summary,
-    stale,
-    staleReason
-  } of unresolvedBlockers) {
+  const inlinePolicyEntries = [];
+  const policySuppressedPaths = [];
+  const inlinePolicyStart = Date.now();
+  for (const record of unresolvedBlockers) {
+    const { filePath: bPath, summary, stale, staleReason } = record;
     const displayPath = toRunnerDisplayPath(cwd, bPath);
+    const tally = { displayPath, sources: record.sources };
     if (stale) {
+      inlinePolicyEntries.push({ ...tally, stale: true });
       const deadLines = blockerPastEof.deadLinesByPath.get(bPath) ?? [];
       const degraded = degradeDemotedFindingBody(summary, { deadLines });
       const retired = runtime.retireDemotedPastEofBlocker(bPath, deadLines);
@@ -499,10 +509,36 @@ export async function handleTurnEnd(deps) {
 ${degraded.body}` + (retirementNote ? `
 ${retirementNote}` : ""));
     } else {
-      blockerParts.push(`Unresolved from this turn — ${displayPath}:
-${summary}`);
+      const policy = applyInlineBlockerPolicy(record, cwd);
+      inlinePolicyEntries.push({ ...tally, stale: false, outcome: policy });
+      if (policy.body === undefined) {
+        policySuppressedPaths.push(bPath);
+        continue;
+      }
+      const suppressedNote = policy.suppressed > 0 ? ` (suppressed by disposition: ${policy.suppressed} finding(s))` : "";
+      blockerParts.push(`Unresolved from this turn — ${displayPath}${suppressedNote}:
+${policy.body}`);
     }
   }
+  const guardLatchBefore = runtime.gitGuardHasBlockers;
+  resyncGitGuardAfterInlinePolicy({
+    runtime,
+    suppressedFilePaths: policySuppressedPaths
+  });
+  if (inlinePolicyEntries.length > 0) {
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "inline_blocker_policy",
+      durationMs: Date.now() - inlinePolicyStart,
+      metadata: {
+        ...summarizeInlineBlockerPolicy(inlinePolicyEntries),
+        guardFilesSuppressed: policySuppressedPaths.length,
+        guardLatchCleared: guardLatchBefore && !runtime.gitGuardHasBlockers
+      }
+    });
+  }
   const cascadeSettleStart = Date.now();
   const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true });
   logLatency({
@@ -550,6 +586,17 @@ ${summary}`);
     return true;
   });
   const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+  let carriedRunsRendered = 0;
+  let labeledAdvisories = 0;
+  const carriedMetaByResult = new Map;
+  for (const r of cascadeRuns) {
+    if (r.result && (r.carriedTurns ?? 0) > 0 && r.carriedTurns !== undefined) {
+      carriedMetaByResult.set(r.result, {
+        carriedTurns: r.carriedTurns,
+        observedAt: r.observedAt
+      });
+    }
+  }
   const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files[0] ?? cwd;
   if (cascadeResults.length > 0) {
     const seen = new Map;
@@ -573,7 +620,12 @@ ${summary}`);
       const pk = normalizeMapKey(result.filePath);
       const ownsAny = result.neighbors.some((n) => neighborOwner.get(normalizeMapKey(n.filePath)) === pk);
       if (ownsAny && result.formatted) {
-        parts.push(result.formatted);
+        const carryMeta = carriedMetaByResult.get(result);
+        const carrySuffix = cascadeCarrySuffix(carryMeta?.carriedTurns, carryMeta?.observedAt);
+        parts.push(carrySuffix ? `${result.formatted}
+${carrySuffix}` : result.formatted);
+        if (carrySuffix)
+          carriedRunsRendered += 1;
         injectedNeighborCount += result.neighbors.length;
         injectedDiagnosticCount += result.neighbors.reduce((s, n) => s + n.diagnostics.length, 0);
       } else if (!ownsAny && result.formatted) {
@@ -666,19 +718,35 @@ ${lines.join(`
     const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" && r.indeterminate?.reason !== "excluded_by_role" && r.indeterminate?.reason !== "budget_truncated" && r.indeterminate?.budget === undefined);
     const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" && r.indeterminate?.budget === undefined);
     const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" || r.indeterminate?.budget !== undefined);
-    const graphAdvisory = buildAdvisory(graphRuns, {
+    const withCarryLabel = (advisory, runs) => {
+      if (advisory === undefined)
+        return;
+      const carried = runs.filter((r) => (r.carriedTurns ?? 0) > 0);
+      if (carried.length === 0 || carried.length !== runs.length) {
+        return advisory;
+      }
+      const stamps = carried.map((r) => r.observedAt);
+      const observedAt = stamps.every((s) => s !== undefined) ? Math.min(...stamps) : undefined;
+      const suffix = cascadeCarrySuffix(carried[0]?.carriedTurns, observedAt);
+      if (!suffix)
+        return advisory;
+      labeledAdvisories += 1;
+      return `${advisory}
+${suffix}`;
+    };
+    const graphAdvisory = withCarryLabel(buildAdvisory(graphRuns, {
       lead: (fileCount, reasons) => `Cascade could not compute downstream impact for ${fileCount} edited file(s) this turn — ` + `the review graph was unavailable (${reasons}), so their dependents were not ` + `cascade-checked and a clean cascade result does not cover them.`,
       fallbackDetail: (r) => r.indeterminate?.reason === "missing_node" ? "changed file not in the review graph" : "review graph unavailable"
-    });
+    }), graphRuns);
     if (graphAdvisory)
       advisoryParts.push(graphAdvisory);
-    const bindingAdvisory = buildAdvisory(bindingRuns, {
+    const bindingAdvisory = withCarryLabel(buildAdvisory(bindingRuns, {
       lead: (fileCount, reasons) => `Cascade identified dependents for ${fileCount} edited file(s) this turn, but their ` + `diagnostics could not be freshly confirmed (${reasons}) and were withheld — a clean ` + `cascade result does not cover them.`,
       fallbackDetail: () => "cascade diagnostics withheld (binding rejected)"
-    });
+    }), bindingRuns);
     if (bindingAdvisory)
       advisoryParts.push(bindingAdvisory);
-    const budgetAdvisory = buildAdvisory(budgetRuns, {
+    const budgetAdvisory = withCarryLabel(buildAdvisory(budgetRuns, {
       lead: (fileCount, reasons) => `Cascade checked the selected neighbors for ${fileCount} edited file(s) this turn, ` + `but some eligible dependents were not checked because the cascade budget ` + `was exhausted (${reasons}); a clean cascade result does not cover them.`,
       fallbackDetail: (r) => {
         const budget = r.indeterminate?.budget;
@@ -687,7 +755,7 @@ ${lines.join(`
         const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
         return budget.transitiveTruncated ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated` : detail;
       }
-    });
+    }), budgetRuns);
     if (budgetAdvisory)
       advisoryParts.push(budgetAdvisory);
     const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
@@ -711,6 +779,13 @@ ${lines.join(`
       }
     });
   }
+  if (carriedRunsRendered > 0 || labeledAdvisories > 0) {
+    logCascade({
+      phase: "cascade_carry_rendered",
+      filePath: cascadeLogFilePath,
+      metadata: { carriedRunsRendered, labeledAdvisories }
+    });
+  }
   const cascadeSkipped = {
     blockers: 0,
     non_code: 0,
@@ -764,6 +839,7 @@ ${lines.join(`
         totalIssues: knipResult.issues.length,
         newIssues: 0,
         blockerIssues: 0,
+        dispositionSuppressed: 0,
         ...!knipResult.success && { reason: knipResult.summary },
         ...knipResult.failureKind && { failureKind: knipResult.failureKind },
         ...knipWouldPoison && { cacheKept: true }
@@ -785,7 +861,17 @@ ${lines.join(`
           projectDiagnosticsDelta.push(...knipIssuesToProjectDiagnostics(cwd, newIssues));
           projectDiagnosticsSources.add("knip");
         }
-        const blockerIssues = newIssues.filter((i) => i.type === "unlisted" || i.type === "bin");
+        const knipPaired = newIssues.flatMap((issue) => knipIssuesToProjectDiagnostics(cwd, [issue]).map((diagnostic) => ({
+          issue,
+          diagnostic
+        })));
+        const knipFiltered = filterFindingsByDisposition(knipPaired, cwd, (pair) => pair.diagnostic);
+        const knipDeliverable = {
+          kept: knipFiltered.kept.map((pair) => pair.issue),
+          suppressed: knipFiltered.suppressed
+        };
+        knipMeta.dispositionSuppressed = knipDeliverable.suppressed;
+        const blockerIssues = knipDeliverable.kept.filter((i) => i.type === "unlisted" || i.type === "bin");
         knipMeta.blockerIssues = blockerIssues.length;
         if (blockerIssues.length > 0) {
           let report = `\uD83D\uDD34 New unresolved imports/deps in modified code (Knip):
@@ -804,7 +890,7 @@ ${lines.join(`
           }
           blockerParts.push(report);
         }
-        const unusedExportDelta = newIssues.filter((i) => i.type === "export" || i.type === "enumMember");
+        const unusedExportDelta = knipDeliverable.kept.filter((i) => i.type === "export" || i.type === "enumMember");
         if (unusedExportDelta.length > 0) {
           let report = `⚠️ Newly unused exports in files you edited — check if callers need updating (Knip):
 `;
@@ -838,6 +924,7 @@ ${lines.join(`
     let modifiedSet = null;
     const modifiedFiles = () => modifiedSet ??= new Set(files.map((f) => resolveRunnerPath(cwd, f)));
     let newIssueTotal = 0;
+    let deadCodeDispositionSuppressed = 0;
     const reasons = [];
     try {
       for (const client of deadCodeClients) {
@@ -906,7 +993,13 @@ ${lines.join(`
           newIssueTotal += newIssues.length;
           projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
           projectDiagnosticsSources.add("dead-code");
-          advisoryParts.push(formatDeadCodeDelta(newIssues, result.language));
+          const deadCodeDeliverable = filterFindingsByDisposition(newIssues, cwd, (issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language));
+          deadCodeDispositionSuppressed += deadCodeDeliverable.suppressed;
+          if (deadCodeDeliverable.kept.length === 0) {
+            reasons.push(`${client.id}:all_disposed`);
+            continue;
+          }
+          advisoryParts.push(formatDeadCodeDelta(deadCodeDeliverable.kept, result.language));
         } catch (err) {
           dbg(`turn_end: dead-code(${client.id}) failed: ${err}`);
           reasons.push(`${client.id}:threw`);
@@ -917,6 +1010,7 @@ ${lines.join(`
       reasons.push("block_threw");
     }
     deadCodeMeta.newIssues = newIssueTotal;
+    deadCodeMeta.dispositionSuppressed = deadCodeDispositionSuppressed;
     if (reasons.length > 0)
       deadCodeMeta.reason = reasons.join(",");
   }
@@ -936,115 +1030,72 @@ ${lines.join(`
     dispositionSuppressedTotal += count;
     dispositionSuppressedByLane[lane] = (dispositionSuppressedByLane[lane] ?? 0) + count;
   }
-  const govCacheEntry = cacheManager.readCache("govulncheck", cwd);
-  const govGate = gateFindingsByPathFreshness({
-    store: "govulncheck",
-    findings: govCacheEntry?.data?.findings ?? [],
-    cwd,
-    scannedAt: govCacheEntry?.data?.scannedAt,
-    citedPath: (finding) => finding.trace.find((t) => t.filename)?.filename,
-    onMissing: "demote"
-  });
-  const govStale = new Set(govGate.stale);
-  const govFiltered = filterFindingsByDisposition([...govGate.live, ...govGate.stale], cwd, (f) => govulncheckFindingToProjectDiagnostic(cwd, f));
-  recordDispositionSuppressed("govulncheck", govFiltered.suppressed);
-  const govFindings = govFiltered.kept;
-  if (govFindings.length) {
-    const findings = govFindings.slice(0, 5);
-    let report = `\uD83D\uDEE1️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:
-`;
-    for (const f of findings) {
-      const callSite = f.trace.find((t) => t.filename);
-      const stale = govStale.has(f);
-      const where = callSite?.filename ? `${toRunnerDisplayPath(cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}` : f.module ?? f.packageName ?? "(module)";
-      const fix = f.fixedVersion ? ` — upgrade to ${f.fixedVersion} or later` : " — no fix yet, track upstream";
-      report += `  ${f.osv} (${where})${fix}
-`;
-    }
-    if (govFindings.length > findings.length) {
-      report += `  … and ${govFindings.length - findings.length} more
-`;
+  const scannerCacheReads = new Map;
+  const scannerStoresUnread = [];
+  function readScannerCache(scanner) {
+    let pending = scannerCacheReads.get(scanner);
+    if (pending === undefined) {
+      pending = deps.signal?.aborted ? Promise.resolve(null) : bounded(cacheManager.readCacheAsync(scanner, cwd), {
+        ms: HOOK_WALL_BUDGET_MS.turn_end,
+        signal: deps.signal,
+        hook: "turn_end",
+        label: `readScannerCache:${scanner}`
+      }).then((entry) => {
+        if (entry === undefined)
+          scannerStoresUnread.push(scanner);
+        return entry ?? null;
+      });
+      scannerCacheReads.set(scanner, pending);
     }
-    advisoryParts.push(report);
+    return pending;
   }
-  const trivyCacheEntry = cacheManager.readCache("trivy", cwd);
-  const gitleaksData = cacheManager.readCache("gitleaks", cwd)?.data;
-  const trivySecretsData = trivyCacheEntry?.data;
-  const gitleaksGate = gateFindingsByPathFreshness({
-    store: "gitleaks",
-    findings: gitleaksData?.findings ?? [],
+  const laneCtx = {
     cwd,
-    scannedAt: gitleaksData?.scannedAt,
-    citedPath: (finding) => finding.file
-  });
-  const trivySecretsGate = gateFindingsByPathFreshness({
-    store: "trivy-secrets",
-    findings: trivySecretsData?.secrets ?? [],
+    signal: deps.signal,
+    readScannerCache,
+    peekActionableWarnings: () => runtime.peekActionableWarnings()
+  };
+  const govSources = await govulncheckLane.collect(laneCtx);
+  const trivyCacheEntry = await readScannerCache("trivy");
+  const secretsSources = await secretsLane.collect(laneCtx);
+  if (scannerStoresUnread.length > 0) {
+    logLatency({
+      type: "phase",
+      toolName: "turn_end",
+      filePath: cwd,
+      phase: "scanner_cache_read_abandoned",
+      durationMs: 0,
+      metadata: {
+        stores: scannerStoresUnread.join("+"),
+        aborted: deps.signal?.aborted === true
+      }
+    });
+  }
+  const scannerGates = gateFindingsByPathFreshness({
     cwd,
-    scannedAt: trivySecretsData?.scannedAt,
-    citedPath: (finding) => finding.file
-  });
-  const gitleaksLiveFiltered = filterFindingsByDisposition(gitleaksGate.live, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
-  const gitleaksStaleFiltered = filterFindingsByDisposition(gitleaksGate.stale, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
-  recordDispositionSuppressed("gitleaks", gitleaksLiveFiltered.suppressed + gitleaksStaleFiltered.suppressed);
-  const trivySecretsLiveFiltered = filterFindingsByDisposition(trivySecretsGate.live, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
-  const trivySecretsStaleFiltered = filterFindingsByDisposition(trivySecretsGate.stale, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
-  recordDispositionSuppressed("trivy-secrets", trivySecretsLiveFiltered.suppressed + trivySecretsStaleFiltered.suppressed);
-  const astSecretWarnings = runtime.peekActionableWarnings().filter(isSecretWarning);
-  const sessionSecrets = dedupeSecretFindings([
-    ...fromGitleaks(gitleaksLiveFiltered.kept),
-    ...fromTrivySecrets(trivySecretsLiveFiltered.kept)
-  ]);
-  const staleSecretEntries = [
-    ...gitleaksStaleFiltered.kept.map((f) => ({
-      file: toRunnerDisplayPath(cwd, f.file),
-      rule: f.ruleId,
-      source: "gitleaks"
-    })),
-    ...trivySecretsStaleFiltered.kept.map((f) => ({
-      file: toRunnerDisplayPath(cwd, f.file),
-      rule: f.ruleId,
-      source: "trivy"
-    }))
-  ];
-  const staleSecrets = [
-    ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values()
-  ];
-  const secretBlockedLocations = new Set(sessionSecrets.map((f) => secretLocationKey(f.file, f.line)));
-  if (sessionSecrets.length) {
-    const enriched = dedupeSecretFindings([
-      ...sessionSecrets,
-      ...fromAstGrepWarnings(astSecretWarnings).filter((a) => secretBlockedLocations.has(secretLocationKey(a.file, a.line)))
-    ]);
-    const shown = enriched.slice(0, 5);
-    let report = `\uD83D\uDD34 STOP — hardcoded secrets detected. Rotate the credentials and remove them from source:
-`;
-    for (const f of shown) {
-      const where = `${toRunnerDisplayPath(cwd, f.file)}:${f.line}`;
-      report += `  ${where} — ${f.rule} [${f.sources.join(" + ")}]${f.description ? `: ${f.description}` : ""}
-`;
-    }
-    if (enriched.length > shown.length) {
-      report += `  … and ${enriched.length - shown.length} more
-`;
+    sources: {
+      ...govSources,
+      ...secretsSources
     }
-    blockerParts.push(report);
+  });
+  const govGate = scannerGates.govulncheck;
+  const gitleaksGate = scannerGates.gitleaks;
+  const trivySecretsGate = scannerGates["trivy-secrets"];
+  const govDelivery = govulncheckLane.render(govulncheckLane.gate({ govulncheck: govGate }, laneCtx), laneCtx);
+  for (const [store, count] of Object.entries(govDelivery.dispositionSuppressed ?? {})) {
+    recordDispositionSuppressed(store, count);
   }
-  if (staleSecrets.length) {
-    const shown = staleSecrets.slice(0, 5);
-    let report = `\uD83D\uDD11 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}
-` + `The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:
-`;
-    for (const entry of shown) {
-      report += `  ${entry.file} — ${entry.rule} [${entry.source}]
-`;
-    }
-    if (staleSecrets.length > shown.length) {
-      report += `  … and ${staleSecrets.length - shown.length} more
-`;
-    }
-    staleSecretParts.push(report);
+  advisoryParts.push(...govDelivery.advisoryParts ?? []);
+  const secretsDelivery = secretsLane.render(secretsLane.gate({
+    gitleaks: gitleaksGate,
+    "trivy-secrets": trivySecretsGate
+  }, laneCtx), laneCtx);
+  for (const [store, count] of Object.entries(secretsDelivery.dispositionSuppressed ?? {})) {
+    recordDispositionSuppressed(store, count);
   }
+  const secretBlockedLocations = secretsDelivery.deliveredLocationKeys ?? new Set;
+  blockerParts.push(...secretsDelivery.blockerParts ?? []);
+  staleSecretParts.push(...secretsDelivery.staleSecretParts ?? []);
   const trivyAgeLabel = formatCacheAgeLabel(trivyCacheEntry?.data?.scannedAt);
   const trivyFindingsFiltered = filterFindingsByDisposition(trivyCacheEntry?.data?.findings ?? [], cwd, (f) => trivyFindingToProjectDiagnostic(cwd, f));
   recordDispositionSuppressed("trivy", trivyFindingsFiltered.suppressed);
@@ -1118,9 +1169,6 @@ ${lines.join(`
         const depResult = depResults.get(absPath);
         if (!depResult)
           continue;
-        if (depResult.localSkips && depResult.localSkips > 0) {
-          dbg(`turn_end: madge skipped ${depResult.localSkips} local file(s) resolving ${file} — possible silent cycle-miss`);
-        }
         if (depResult.hasCircular && depResult.circular.length > 0) {
           dbg(`turn_end: circular dependency note for ${file} (suppressed in blockers-only mode)`);
         }
@@ -1241,6 +1289,7 @@ ${lines.join(`
         heldDeferred.push({
           testFile,
           runner: carried.runner,
+          sourceFile: carried.sourceFile ?? testFile,
           attempts,
           sessionId: turnSessionId
         });
@@ -1251,6 +1300,7 @@ ${lines.join(`
       redispatchedDeferred++;
       targets.push({
         testFile,
+        sourceFile: carried.sourceFile ?? testFile,
         runner: carried.runner,
         config,
         strategy: "deferred",
@@ -1313,7 +1363,7 @@ ${lines.join(`
           overCapTargets++;
           continue;
         }
-        targets.push(target);
+        targets.push({ ...target, sourceFile: abs });
         dbg(`turn_end: ${display} → test ${target.runner} ${path.relative(cwd, target.testFile)} (${target.strategy}${isNeighbor ? ", cascade-neighbor" : ""})`);
       } else if (!target) {
         dbg(`turn_end: ${display} → no test file found${isNeighbor ? " (cascade-neighbor)" : ""}`);
@@ -1337,6 +1387,9 @@ ${lines.join(`
       dbg(`turn_end: test target count capped at ${TEST_RUNNER_MAX_TARGETS}, ${overCapTargets} skipped`);
     }
     if (targets.length > 0) {
+      for (const target of targets) {
+        target.fileSeqAtRun = runtime.getFileSeq(target.sourceFile);
+      }
       dbg(`turn_end: firing ${targets.length} test target(s) async (non-blocking, max ${TEST_RUNNER_BATCH_CONCURRENCY} concurrent)`);
       const firedAtTurn = runtime.turnIndex;
       const firedSessionId = turnSessionId;
@@ -1373,8 +1426,28 @@ ${lines.join(`
           signal: batchSignal
         })
       }).then(({ results, deferred, stopReason }) => {
+        const settledResults = results;
+        const verdicts = settledResults.flatMap((result) => {
+          if (result.status === "rejected")
+            return [];
+          const target = targets.find((candidate) => candidate.testFile === result.value.file);
+          return target ? [
+            {
+              file: result.value.file,
+              sourceFile: target.sourceFile,
+              fileSeq: target.fileSeqAtRun === undefined ? {
+                state: "unknown",
+                reason: "sequence-unavailable"
+              } : {
+                state: "known",
+                value: target.fileSeqAtRun
+              }
+            }
+          ] : [];
+        });
         const deferredTargets = deferred.map((t) => ({
           testFile: t.testFile,
+          sourceFile: t.sourceFile,
           runner: t.runner,
           attempts: (t.deferralAttempts ?? 0) + 1,
           sessionId: firedSessionId
@@ -1442,7 +1515,7 @@ ${lines.join(`
           const shortFile = path.basename(file);
           const elapsed = formatRunDurationMs(duration);
           const verdict = failed > 0 ? "FAIL" : "PASS";
-          const summary = error && passed === 0 && failed === 0 ? `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
+          const summary = isRunnerErrorResult(r.value) ? passed > 0 ? `error: ${error} (${passed} passed before)` : `error: ${error}` : `${verdict} ${passed}p/${failed}f (${elapsed})`;
           dbg(`turn_end: ${stale ? "[stale] " : ""}test ${runner} ${shortFile} → ${summary}`);
           if (failed > 0 || error) {
             if (error && String(r.value?.error ?? "").includes("Test file not found")) {
@@ -1473,6 +1546,7 @@ ${lines.join(`
             content,
             stale,
             results: resultValues,
+            verdicts,
             testRunGeneration,
             launchedFrom,
             publishedAgainst,
@@ -1496,7 +1570,25 @@ ${lines.join(`
             if (cleanFiles.length > 0) {
               clearGitGuardTestFailure(cacheManager, cwd, runtime, cleanFiles);
             }
-            mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues.filter((value) => value.failed > 0).map((value) => value.file));
+            if (!runnerErrorOnly) {
+              mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues.filter((value) => value.failed > 0).map((value) => value.file));
+            } else {
+              emitBounded("test_runner_delivery", `${cwd}:generation:${testRunGeneration}:runner-error-only`, {
+                filePath: cwd,
+                durationMs: 0,
+                metadata: {
+                  outcome: "runner-error-only-not-blocking",
+                  sessionId: firedSessionId,
+                  generation: testRunGeneration,
+                  targetCount: targets.length,
+                  droppedDetailCount: 0
+                }
+              }, {
+                ledgerKind: "test-runner-delivery",
+                reason: "runner-error-only batch kept off the --lens-guard blocker",
+                capPerTurn: { limit: 8, turnIndex: firedAtTurn }
+              });
+            }
           }
           dbg(`turn_end: ${failures.length} test failure(s) cached for pull diagnostics and post-agent delivery${stale ? " (stale — turn advanced while tests ran)" : ""}`);
         } else if (deferred.length > 0) {
@@ -1506,6 +1598,7 @@ ${lines.join(`
             content: deferralNote,
             stale,
             results: resultValues,
+            verdicts,
             testRunGeneration,
             launchedFrom,
             publishedAgainst,
@@ -1572,10 +1665,12 @@ ${lines.join(`
     if (!coverage || coverage.complete !== true) {
       advisoryParts.push("Call-graph impact was not emitted because call-graph extraction coverage is incomplete; " + "the affected files may have unreported callers.");
     } else {
+      const callGraphStart = Date.now();
       try {
         const { impact, formatImpact, parseSymbolKey } = await import("./call-graph.js");
         const { callGraphImpactToProjectDiagnostics } = await import("./project-diagnostics/runner-adapters/call-graph-impact.js");
         const impactLines = [];
+        let callGraphDispositionSuppressed = 0;
         const impactFindings = [];
         for (const filePath of files.slice(0, 5)) {
           const changedFileKey = normalizeMapKey(resolveRunnerPath(cwd, filePath));
@@ -1590,7 +1685,15 @@ ${lines.join(`
             });
             if (results.length > 0) {
               impactFindings.push({ calleeKey, results });
-              const summary = formatImpact(results, cwd);
+              const markable = results.flatMap((result) => callGraphImpactToProjectDiagnostics(cwd, [
+                { calleeKey, results: [result] }
+              ]).map((diagnostic) => ({ result, diagnostic })));
+              const filtered = filterFindingsByDisposition(markable, cwd, (entry) => entry.diagnostic);
+              callGraphDispositionSuppressed += filtered.suppressed;
+              const keptEntries = new Set(filtered.kept);
+              const dropped = new Set(markable.filter((entry) => !keptEntries.has(entry)).map((entry) => entry.result));
+              const survivors = dropped.size === 0 ? results : results.filter((r) => !dropped.has(r));
+              const summary = survivors.length > 0 ? formatImpact(survivors, cwd) : "";
               if (summary)
                 impactLines.push(`  ${parseSymbolKey(calleeKey).symbolName ?? calleeKey}: ${summary}`);
             }
@@ -1608,6 +1711,20 @@ ${impactLines.join(`
             projectDiagnosticsSources.add("call-graph");
           }
         }
+        if (impactFindings.length > 0 || callGraphDispositionSuppressed > 0) {
+          logLatency({
+            type: "phase",
+            toolName: "turn_end",
+            filePath: cwd,
+            phase: "call_graph_impact",
+            durationMs: Date.now() - callGraphStart,
+            metadata: {
+              callees: impactFindings.length,
+              lines: impactLines.length,
+              dispositionSuppressed: callGraphDispositionSuppressed
+            }
+          });
+        }
       } catch {}
     }
   }
@@ -1637,7 +1754,25 @@ ${impactLines.join(`
       fileSeqByPath.set(filePath, getFileSeq.call(runtime, filePath));
     }
   }
+  let reverify;
   if (getFlag("lens-actionable-warnings")) {
+    const persistedReport = cacheManager.readCache("actionable-warnings", cwd, Number.MAX_SAFE_INTEGER)?.data;
+    if (persistedReport?.files?.some((entry) => entry.origin === "deferred")) {
+      const reverifyLspService = getLSPService();
+      if (reverifyLspService) {
+        reverify = await bounded(runPersistentReverify({
+          report: persistedReport,
+          cwd,
+          lspService: reverifyLspService,
+          signal: getAmbientAbortSignal()
+        }), {
+          ms: HOOK_WALL_BUDGET_MS.turn_end,
+          signal: getAmbientAbortSignal(),
+          hook: "turn_end",
+          label: "persistent_reverify"
+        });
+      }
+    }
     try {
       const report = await buildActionableWarningsReport({
         cwd,
@@ -1645,7 +1780,7 @@ ${impactLines.join(`
         turnIndex: runtime.turnIndex,
         files,
         modifiedRangesByFile,
-        dispatchWarnings: runtime.peekActionableWarnings().filter((w) => !(isSecretWarning(w) && typeof w.line === "number" && secretBlockedLocations.has(secretLocationKey(w.filePath, w.line)))),
+        dispatchWarnings: runtime.peekActionableWarnings(),
         includeLspCodeActions: !!getFlag("lens-actionable-warning-actions"),
         projectSeqStart: runtime.turnStartProjectSeq,
         projectSeqEnd: runtime.projectSeq,
@@ -1667,12 +1802,50 @@ ${impactLines.join(`
           }
         }
       });
+      if (reverify?.replacementFiles.length) {
+        const replacementByPath = new Map(reverify.replacementFiles.map((file) => [
+          normalizeMapKey(file.filePath),
+          file
+        ]));
+        const files = (report.files ?? []).map((file) => replacementByPath.get(normalizeMapKey(file.filePath)) ?? file);
+        for (const replacement of reverify.replacementFiles) {
+          if (!files.some((file) => normalizeMapKey(file.filePath) === normalizeMapKey(replacement.filePath))) {
+            files.push(replacement);
+          }
+        }
+        report.files = files;
+      }
       const publishResult = publishActionableWarningsReport(cacheManager, cwd, report, {
         origin: "in-band",
         getFileSeq: getFileSeq ? (filePath) => getFileSeq.call(runtime, filePath) : undefined,
         dbg
       });
-      const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd);
+      const advisory = formatActionableWarningsAdvisory(publishResult.report, cwd, host, (report) => {
+        let dispositionSuppressed = 0;
+        const files = report.files.map((file) => {
+          const policy = filterFindingsByDisposition(file.warnings, cwd, (warning) => {
+            const { line, column, rule, code } = warning;
+            return {
+              filePath: warning.filePath,
+              severity: warning.severity,
+              semantic: "warning",
+              tool: warning.tool,
+              runner: warning.tool,
+              message: warning.message,
+              source: warning.origin === "lsp" ? "lsp" : "dispatch",
+              ...line === undefined ? {} : { line: warning.line },
+              ...column === undefined ? {} : { column: warning.column },
+              ...rule === undefined ? {} : { rule: warning.rule },
+              ...code === undefined ? {} : { code }
+            };
+          });
+          dispositionSuppressed += policy.suppressed;
+          const kept = policy.kept.filter((warning) => !(isSecretWarning(warning) && typeof warning.line === "number" && secretBlockedLocations.has(secretLocationKey(warning.filePath, warning.line))));
+          return kept.length > 0 ? { ...file, warnings: kept } : undefined;
+        }).filter((file) => file !== undefined);
+        recordDispositionSuppressed("actionable-warnings", dispositionSuppressed);
+        return { files, suppressed: dispositionSuppressed };
+      });
       if (advisory)
         advisoryParts.push(advisory);
       logActionableWarningsEvent({
@@ -1708,11 +1881,36 @@ ${impactLines.join(`
   }
   const t5 = Date.now();
   try {
+    const qualityWarningsByFile = new Map;
+    for (const warning of runtime.peekCodeQualityWarnings()) {
+      const group = qualityWarningsByFile.get(warning.filePath);
+      if (group)
+        group.push(warning);
+      else
+        qualityWarningsByFile.set(warning.filePath, [warning]);
+    }
+    const qualityWarnings = [];
+    let qualityDispositionSuppressed = 0;
+    for (const [filePath, group] of qualityWarningsByFile) {
+      let content;
+      try {
+        content = fs.readFileSync(filePath, "utf-8");
+      } catch {
+        content = undefined;
+      }
+      const { kept, suppressed } = applyPushedFindingPolicy(group, {
+        cwd,
+        filePath,
+        content
+      });
+      qualityWarnings.push(...kept);
+      qualityDispositionSuppressed += suppressed;
+    }
     const qualityReport = buildCodeQualityWarningsReport({
       cwd,
       sessionId: runtime.telemetrySessionId,
       turnIndex: runtime.turnIndex,
-      warnings: runtime.peekCodeQualityWarnings(),
+      warnings: qualityWarnings,
       modifiedRangesByFile,
       projectSeqStart: runtime.turnStartProjectSeq,
       projectSeqEnd: runtime.projectSeq,
@@ -1720,7 +1918,7 @@ ${impactLines.join(`
     });
     writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
     appendCodeQualityWarningsHistory(cwd, qualityReport);
-    const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd);
+    const advisory = formatCodeQualityWarningsAdvisory(qualityReport, cwd, host);
     if (advisory)
       advisoryParts.push(advisory);
     logLatency({
@@ -1729,7 +1927,10 @@ ${impactLines.join(`
       filePath: cwd,
       phase: "code_quality_warnings_report",
       durationMs: Date.now() - t5,
-      metadata: qualityReport.summary
+      metadata: {
+        ...qualityReport.summary,
+        dispositionSuppressed: qualityDispositionSuppressed
+      }
     });
   } catch (err) {
     dbg(`turn_end: code quality warning report failed: ${err}`);
@@ -1752,6 +1953,7 @@ ${impactLines.join(`
   let runnerFindingsStale = 0;
   let runnerFindingsFailed = 0;
   let runnerFindingsDropped = 0;
+  let runnerFindingsDispositionSuppressed = 0;
   const runnerFindingsDeliveredIds = [];
   for (const pending of pendingRunnerFindings) {
     const result = pending.result;
@@ -1767,12 +1969,15 @@ ${impactLines.join(`
     const findings = result.diagnostics;
     if (findings.length === 0)
       continue;
-    const gate = gateFindingsByPathFreshness({
-      store: "late-runner-findings",
-      findings,
+    const { "late-runner-findings": gate } = gateFindingsByPathFreshness({
       cwd,
-      scannedAt: pending.markedAtMs,
-      citedPath: (finding) => finding.filePath
+      sources: {
+        "late-runner-findings": {
+          findings,
+          scannedAt: pending.markedAtMs,
+          citedPath: (finding) => finding.filePath
+        }
+      }
     });
     runnerFindingsStale += gate.stale.length;
     if (gate.stale.length > 0) {
@@ -1782,14 +1987,30 @@ ${impactLines.join(`
     if (gate.live.length === 0)
       continue;
     const displayPath = toRunnerDisplayPath(cwd, pending.filePath);
-    const lines = gate.live.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
-    runnerFindingsDelivered += gate.live.length;
-    for (const finding of gate.live) {
+    let runnerContent;
+    try {
+      runnerContent = fs.readFileSync(pending.filePath, "utf-8");
+    } catch {
+      runnerContent = undefined;
+    }
+    const { kept: runnerKept, suppressed: runnerSuppressedHere } = applyPushedFindingPolicy(gate.live, {
+      cwd,
+      filePath: pending.filePath,
+      content: runnerContent
+    });
+    runnerFindingsDispositionSuppressed += runnerSuppressedHere;
+    if (runnerKept.length === 0) {
+      continue;
+    }
+    const lines = runnerKept.map((finding) => `  ${displayPath}:${finding.line ?? 1}:${finding.column ?? 1} [${finding.rule ?? finding.id}] ${finding.message}`);
+    runnerFindingsDelivered += runnerKept.length;
+    for (const finding of runnerKept) {
       if (runnerFindingsDeliveredIds.length < 50) {
         runnerFindingsDeliveredIds.push(finding.id);
       }
     }
-    advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit):
+    const runnerSuppressedNote = runnerSuppressedHere > 0 ? `; suppressed by disposition: ${runnerSuppressedHere} finding(s)` : "";
+    advisoryParts.push(`⏱️ Late runner diagnostics (${pending.runnerId} completed after the edit${runnerSuppressedNote}):
 ${lines.join(`
 `)}`);
   }
@@ -1805,6 +2026,7 @@ ${lines.join(`
       stale: runnerFindingsStale,
       failed: runnerFindingsFailed,
       dropped: runnerFindingsDropped,
+      dispositionSuppressed: runnerFindingsDispositionSuppressed,
       deliveredIds: runnerFindingsDeliveredIds
     }
   });
@@ -1822,11 +2044,14 @@ ${lines.join(`
   let lateAuxCeilingExhausted = 0;
   let lateAuxAnswered = 0;
   let lateAuxNotifyStallDemoted = 0;
+  let lateAuxDispositionSuppressed = 0;
+  let lateAuxAuxSuppressed = 0;
   const lateAuxCoverageGapPairs = [];
   let lateAuxCoverageGapDetailCount = 0;
   let lateAuxCoverageGapDropCount = 0;
   const lateAuxStuckPairs = [];
   if (drainedPairs.length > 0) {
+    const lateObserverDeadline = Date.now() + HOOK_WALL_BUDGET_MS.turn_end;
     const byFile = new Map;
     for (const pair of drainedPairs) {
       const list = byFile.get(pair.filePath);
@@ -1856,6 +2081,19 @@ ${lines.join(`
           continue;
         }
         const displayLateAuxPath = toRunnerDisplayPath(cwd, lateAuxPath);
+        let lateAuxContentRead = false;
+        let lateAuxContentValue;
+        const readLateAuxContent = () => {
+          if (!lateAuxContentRead) {
+            lateAuxContentRead = true;
+            try {
+              lateAuxContentValue = fs.readFileSync(lateAuxPath, "utf-8");
+            } catch {
+              lateAuxContentValue = undefined;
+            }
+          }
+          return lateAuxContentValue;
+        };
         for (const pair of pairs) {
           const cachedEntry = cached.get(pair.serverId);
           if (cachedEntry === undefined) {
@@ -1908,27 +2146,44 @@ ${lines.join(`
             }
             continue;
           }
+          if (typeof service.observeLateAuxiliaryAnswer === "function") {
+            await bounded(service.observeLateAuxiliaryAnswer(lateAuxPath, pair.serverId, cachedEntry.publishedAt - pair.markedAtMs), {
+              ms: Math.max(1, lateObserverDeadline - Date.now()),
+              signal: deps.signal,
+              hook: "turn_end",
+              label: "observeLateAuxiliaryAnswer"
+            });
+          }
           if (rawDiags.length === 0) {
             lateAuxCleanConfirmed += 1;
             continue;
           }
-          const converted = convertLspDiagnostics(rawDiags, lateAuxPath, {
-            tool: "lsp"
-          });
-          if (converted.length === 0) {
+          const anchored = rawDiags.filter((d) => d.range?.start?.line !== undefined);
+          if (anchored.length === 0) {
             lateAuxMissing += rawDiags.length;
             lateAuxAnswered += 1;
             continue;
           }
-          const gate = gateFindingsByPathFreshness({
-            store: "late-auxiliary-findings",
-            findings: converted,
+          const lateAuxContent = readLateAuxContent();
+          const converted = convertLspDiagnostics(anchored, lateAuxPath);
+          const retained = retagAuxiliaryDiagnostics(converted, anchored, lateAuxContent ?? "", { cwd, fileRole: detectFileRole(lateAuxPath, lateAuxContent) });
+          lateAuxAuxSuppressed += converted.length - retained.length;
+          if (retained.length === 0) {
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const { "late-auxiliary-findings": gate } = gateFindingsByPathFreshness({
             cwd,
-            scannedAt: pair.markedAtMs,
-            citedPath: () => lateAuxPath
+            sources: {
+              "late-auxiliary-findings": {
+                findings: retained,
+                scannedAt: pair.markedAtMs,
+                citedPath: () => lateAuxPath
+              }
+            }
           });
           lateAuxStale += gate.stale.length;
-          lateAuxMissing += converted.length - gate.live.length - gate.stale.length;
+          lateAuxMissing += retained.length - gate.live.length - gate.stale.length;
           if (gate.live.length === 0) {
             if (gate.stale.length > 0) {
               if (!isPendingAuxiliaryPastRearmTtl(pair) && (pair.rearmCount ?? 0) < MAX_LATE_AUX_REARMS) {
@@ -1944,10 +2199,21 @@ ${lines.join(`
             }
             continue;
           }
-          const lines = gate.live.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
-          lateAuxDelivered += gate.live.length;
+          const { kept: lateAuxKept, suppressed: lateAuxSuppressedHere } = applyPushedFindingPolicy(gate.live, {
+            cwd,
+            filePath: lateAuxPath,
+            content: lateAuxContent
+          });
+          lateAuxDispositionSuppressed += lateAuxSuppressedHere;
+          if (lateAuxKept.length === 0) {
+            lateAuxAnswered += 1;
+            continue;
+          }
+          const lines = lateAuxKept.map((f) => `  ${displayLateAuxPath}:${f.line}:${f.column} [${f.rule}] ${f.message}`);
+          lateAuxDelivered += lateAuxKept.length;
           lateAuxAnswered += 1;
-          advisoryParts.push(`\uD83D\uDD50 Late auxiliary diagnostics (${pair.serverId} answered after its grace window):
+          const lateAuxSuppressedNote = lateAuxSuppressedHere > 0 ? `; suppressed by disposition: ${lateAuxSuppressedHere} finding(s)` : "";
+          advisoryParts.push(`\uD83D\uDD50 Late auxiliary diagnostics (${pair.serverId} answered after its grace window${lateAuxSuppressedNote}):
 ${lines.join(`
 `)}`);
         }
@@ -1999,6 +2265,8 @@ ${lines.join(`
         expired: lateAuxExpired,
         ceilingExhausted: lateAuxCeilingExhausted,
         answered: lateAuxAnswered,
+        dispositionSuppressed: lateAuxDispositionSuppressed,
+        auxSuppressed: lateAuxAuxSuppressed,
         notifyStallDemoted: lateAuxNotifyStallDemoted,
         coverageGapReRaised: lateAuxCoverageGapPairs.length,
         coverageGapReRaisedDetailed: lateAuxCoverageGapDetailCount,
@@ -2046,7 +2314,7 @@ ${p}`);
           });
         }
       }
-      cacheManager.clearTurnState(cwd, currentOwner);
+      clearOwnedTurnState();
       runtime.fixedThisTurn.clear();
       resetFormatService();
       return;
@@ -2125,7 +2393,7 @@ ${p}`);
     });
   }
   if (blockerParts.length === 0) {
-    cacheManager.clearTurnState(cwd, currentOwner);
+    clearOwnedTurnState();
     if (getFlag("lens-guard") && advisoryParts.length === 0 && staleSecretParts.length === 0 && !runtime.gitGuardHasBlockers) {
       const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
       if (guardRecord?.sessionId === runtime.telemetrySessionId && guardRecord.testFailures !== true) {