@herbertgao/pi-extensions 2026.10.1 → 2026.10.2

package/node_modules/pi-lens/dist/tools/lens-diagnostics.js

@@ -1,2571 +0,0 @@
-/**
- * lens_diagnostics tool — cached project diagnostic state (issue #159).
- *
- * Three modes:
- *   delta (default) — fixable warnings from the current agent turn, read from
- *                     the actionable-warnings and code-quality-warnings caches.
- *   all             — all known diagnostic counts across every file pi-lens has
- *                     seen this session, read from the widget state.
- *   full            — active project-wide LSP diagnostic scan merged with all.
- */
-import { promises as fs } from "node:fs";
-import * as fsSync from "node:fs";
-import * as path from "node:path";
-import { BoundedLruCache } from "../clients/bounded-cache.js";
-import { Type } from "../clients/deps/typebox.js";
-import { anchorsForDiagnostic, applyDispositions, applyWeakDispositions, hasAnyDispositionMarks, hasStrictDispositionMarks, getDisposition, } from "../clients/diagnostic-dispositions.js";
-import { DEPENDENCY_DRIFT_MAX_DELIVERIES } from "../clients/blocker-freshness.js";
-import { freshnessFromMtime } from "../clients/freshness.js";
-import { applyFindingPolicy, loadProjectRulePolicyMap, } from "../clients/dispatch/finding-policy.js";
-import { gateFindingsByPathFreshness } from "../clients/advisory-provenance.js";
-import { formatCacheAgeLabel, markUnreconciledFindings, } from "../clients/finding-delivery-gate.js";
-import { normalizeRuleId } from "../clients/dispatch/rule-id-normalize.js";
-import { applyRulePolicy, } from "../clients/dispatch/rule-policy.js";
-import { compactRenderResult } from "./render-compact.js";
-import { combineAbortSignals } from "../clients/deadline-utils.js";
-import { getProjectIgnoreMatcher } from "../clients/file-utils.js";
-import { isAtOrAboveHomeDir, normalizeEphemeralMapKey, normalizeFilePath, normalizeMapKey, realpathOrResolve, } from "../clients/path-utils.js";
-import { getLSPService } from "../clients/lsp/index.js";
-import { retireInlineBlockerAndResyncGuard } from "../clients/git-guard.js";
-import { primaryServerId, resolveLspCwdForFile, } from "../clients/lsp/config.js";
-import { getFullScanWallClockMs } from "../clients/lsp/workspace-sweep-hold.js";
-import { demoteInferredProjectSweepResults } from "../clients/lsp/inferred-project.js";
-import { hashDiagnosticContent, } from "../clients/lsp/diagnostic-binding.js";
-import { loadProjectDiagnosticsDeltaReport, loadProjectDiagnosticsSnapshot, PROJECT_DIAGNOSTICS_CACHE_VERSION, reconcileProjectDiagnosticsSnapshot, } from "../clients/project-diagnostics/cache.js";
-import { formatCacheAgeOld, formatNotRunEntry, } from "../clients/project-diagnostics/extractors.js";
-import { ANALYZER_IDS, fetchFreshProjectDiagnostics, } from "../clients/project-diagnostics/fresh-fetch.js";
-import { loadBootstrapClients } from "../clients/bootstrap.js";
-import { resolveLensToolName, } from "../clients/tool-config.js";
-import { generatedSkipNotice, scanTruncationNotice, } from "../clients/lens-engine.js";
-import { scanProjectDiagnostics } from "../clients/project-diagnostics/scanner.js";
-import { classifyDiagnosticTier, getFileDiagnosticSummaries, reconcileCorrelatedScanDiagnostics, reconcileScanDiagnostics, reconcileStaleWidgetDependencyBlockers, reconcileStaleWidgetFiles, widgetDiagnosticUri, } from "../clients/widget-state.js";
-import { claimPhaseOncePerSession, logLatency, } from "../clients/latency-logger.js";
-import { logExtension } from "../clients/extension-log.js";
-import { recordDegradationOnce } from "../clients/degradation-ledger.js";
-import { convertLspDiagnostics } from "../clients/dispatch/utils/lsp-diagnostics.js";
-import { findAuxiliaryProfileForSource, retagAuxiliaryDiagnostics, } from "../clients/dispatch/auxiliary-lsp.js";
-import { detectFileRole } from "../clients/file-role.js";
-import { STALE_LINE_MARKER } from "../clients/stale-marker.js";
-import { makeProgressReporter, scanningSummaryLine } from "./scan-progress.js";
-import { createLspDiagnosticsTool, LSP_SEVERITY_FILTERS, MAX_BATCH_FILES, renderBatchOutcomeLines, } from "./lsp-diagnostics.js";
-import { demotePastEofDiagnostics, PAST_EOF_STALE_MARKER, resyncDocumentOnPastEof, } from "../clients/diagnostic-line-freshness.js";
-// The widget state exposes the full per-file diagnostic set; this is the tool's
-// own generous display budget per file (independent of the TUI's 12 cap), to
-// keep output bounded on a pathologically broken file.
-const MAX_DIAGNOSTICS_PER_FILE = 50;
-// `paths` (#461) is a wrapper-facing scope restrictor (e.g. "git-staged files
-// only"), not a bulk-listing mechanism — a wrapper that hits this needs to
-// narrow, not paginate. Erroring (rather than silently truncating) means a
-// caller can never believe it checked files it didn't (issue's stated
-// invariant).
-const MAX_PATHS_ENTRIES = MAX_BATCH_FILES;
-// #1623: the reason rendered for every heavyweight-analyzer lane (gitleaks,
-// trivy, govulncheck, dead-code, knip, jscpd, madge, opengrep, test-runner)
-// when mode=full is called without refreshRunners=cheap/all/cached — the
-// "quick mode" gate that skips the expensive fresh-fetch entirely (see
-// `formatFullMode`'s `analyzersPromise`). One shared function so it renders
-// identically everywhere it's used, naming the tool THIS host can call
-// (#2535 F1 — the shared const named the pi tool on MCP too).
-function notRequestedReason(host) {
-    return ("refreshRunners not requested this call (quick mode) — pass " +
-        `refreshRunners=cheap/all/cached to ${resolveLensToolName("lens_diagnostics", host) ?? "diagnostics"} mode=full to run it`);
-}
-// Wall-clock ceiling for the whole mode=full scan. Even with per-file budgets
-// and abort-signal honoring, a pathological state (a language server hanging on
-// spawn/initialize across many files) could otherwise stall the tool
-// indefinitely — an unattended session was observed hung for ~8h. This hard cap
-// aborts the scan so it always returns (partial) rather than never. Env-tunable.
-// #1618: single source with `clients/runtime-turn.ts`'s idle-reset base delay
-// (see `getBaseLspIdleResetMs`), which derives itself from this value so the
-// two constants can no longer drift back into the idle-reset-fires-mid-sweep
-// relationship that caused #1618 in the first place.
-const FULL_SCAN_WALL_CLOCK_MS = getFullScanWallClockMs();
-// Binding verification is a fallback for result producers that supplied a
-// content hash without an already-computed disk verdict. Keep it one-file-at-a-
-// time and yield periodically: a full scan can contain thousands of results,
-// and a synchronous read loop here would freeze the host even though the LSP
-// work itself was asynchronous (#1198 follow-up).
-const FULL_SCAN_BINDING_YIELD_EVERY = 16;
-async function findFullScanBindingMismatches(results) {
-    const mismatched = new WeakSet();
-    let sinceYield = 0;
-    for (const result of results) {
-        if (result.boundToCurrentDisk === false) {
-            mismatched.add(result);
-        }
-        else if (
-        // A `true` verdict came from the LSP/cache binding seam and has already
-        // compared its fingerprint with disk. Only legacy/partial producers need
-        // this fallback read; `unknown` remains unknown when no hash exists.
-        result.boundToCurrentDisk !== true &&
-            result.contentHash !== undefined) {
-            try {
-                // Promise-based, sequential reads bound both event-loop occupancy and
-                // outstanding file handles. A read failure deliberately leaves the
-                // verdict unknown (the historical fail-open behavior).
-                const content = await fs.readFile(result.filePath, "utf-8");
-                if (hashDiagnosticContent(content) !== result.contentHash) {
-                    mismatched.add(result);
-                }
-            }
-            catch {
-                // Unreadable/deleted files cannot disprove the binding. Leave them
-                // unknown for the existing caller policy, rather than manufacturing a
-                // mismatch or a clean verdict here.
-            }
-        }
-        sinceYield += 1;
-        if (sinceYield >= FULL_SCAN_BINDING_YIELD_EVERY) {
-            sinceYield = 0;
-            await new Promise((resolve) => setImmediate(resolve));
-        }
-    }
-    return mismatched;
-}
-export function createLensDiagnosticsTool(cacheManager, getCwd, getLspService = getLSPService, 
-// Flush any debounced per-edit dispatches before reading, so files the agent
-// fixed earlier in the turn are re-dispatched and the widget reflects the
-// CURRENT state — not the pre-fix diagnostics still pending in the debounce
-// window. Injected (index wires `flushDebouncedToolResults`); optional so the
-// tool stays decoupled and testable.
-flushPending = async () => { }, 
-// #571: mode=full's own fresh LSP results are reconciled into the footer
-// (widget-state's `allDiagnostics`) for files this scan got a CONFIRMED
-// (non-timed-out) result for — otherwise an unedited file whose diagnostics
-// only changed because of a change to a file it depends on stays stale in
-// the footer forever. Each reconciled write draws a fresh token from the
-// SAME monotonic source `pipeline.ts`'s per-edit writes use
-// (`RuntimeCoordinator.nextWriteIndex()`, injected by index.ts) so the
-// existing `WriteOrderingGuard` (#555/#560) can tell this scan-originated
-// write apart from a concurrent, genuinely newer per-edit write for the
-// same file. Optional/undefined in tests — an omitted writeIndex always
-// proceeds (see `reconcileScanDiagnostics`'s doc comment).
-nextWriteIndex, 
-// #798/#338: capture host UI methods synchronously from the active tool event.
-// The returned closure is safe for the later async sweep to invoke because it
-// never dereferences the session-guarded ctx.ui getter.
-captureLspStatusRepaint, getRuntime, isLensGuardEnabled = () => true) {
-    const lspProbe = createLspDiagnosticsTool(nextWriteIndex, (info) => {
-        const runtime = getRuntime?.();
-        if (!runtime)
-            return;
-        const retired = retireInlineBlockerAndResyncGuard({
-            runtime,
-            cacheManager,
-            cwd: info.cwd,
-            filePath: info.filePath,
-            ...(info.writeIndex === undefined
-                ? {}
-                : { writeIndex: info.writeIndex }),
-            coveredSources: info.coveredSources,
-            lensGuardEnabled: isLensGuardEnabled(),
-        });
-        if (retired) {
-            logExtension({
-                subsystem: "git-guard",
-                level: "debug",
-                message: `inline_blocker: retired for ${info.filePath}`,
-            });
-        }
-    }, getLspService);
-    return {
-        name: "lens_diagnostics",
-        label: "Project Diagnostics",
-        description: 'Query pi-lens diagnostics from the session cache or an active LSP probe, at paths or workspace scope. Empty cache is not proof of clean; probe changed paths when findings are absent or stale. Example: `{source: "lsp", scope: "paths", paths: ["src/app.ts"]}`.',
-        promptSnippet: "lens_diagnostics source=session reads the session cache and an empty cache is not proof of a clean file; use source=lsp scope=paths for changed files when cached findings are absent or stale",
-        renderResult: compactRenderResult(({ details, args, isError, text }) => {
-            if (details?.source === "lsp") {
-                const count = details.totalDiagnostics ?? 0;
-                const files = details.filesChecked ?? details.filesScanned ?? 0;
-                const noun = count === 1 ? "diagnostic" : "diagnostics";
-                const filePath = typeof details?.filePath === "string"
-                    ? details.filePath
-                    : Array.isArray(args?.paths) &&
-                        args.paths.length === 1 &&
-                        typeof args.paths[0] === "string"
-                        ? args.paths[0]
-                        : undefined;
-                const singleFile = (details?.mode === "file" || files === 1) &&
-                    typeof filePath === "string"
-                    ? ` ${path.basename(filePath)}`
-                    : "";
-                const scope = files > 1 ? ` across ${files} files` : singleFile;
-                if (isError)
-                    return `lens_diagnostics lsp — ${text.split("\n")[0] ?? "error"}`;
-                if ((details.navigationOnlyFiles ?? 0) > 0)
-                    return `lens_diagnostics${scope} — ${count} ${noun} · ${details.cleanFiles ?? 0} clean · ${details.navigationOnlyFiles} navigation-only`;
-                if ((details.unconfirmedFiles ?? 0) > 0)
-                    return `lens_diagnostics${scope} — ${count} ${noun} · ${details.cleanFiles ?? 0} clean · ${details.unconfirmedFiles} unconfirmed${details.timedOutFiles ? ` (${details.timedOutFiles} timed out)` : ""}`;
-                const outcomeCounts = details.outcomeCounts;
-                const tooLargeLines = renderBatchOutcomeLines(details.outcomes ?? []);
-                if (tooLargeLines.length > 0)
-                    return `lens_diagnostics${scope} — too large: ${tooLargeLines.join("; ")}`;
-                const notConfirmed = outcomeCounts
-                    ? (outcomeCounts.inconclusive ?? 0) +
-                        (outcomeCounts.unavailable ?? 0) +
-                        (outcomeCounts.unsupported ?? 0) +
-                        (outcomeCounts.failed ?? 0) +
-                        (outcomeCounts.too_large ?? 0)
-                    : 0;
-                if (notConfirmed > 0)
-                    return `lens_diagnostics${scope} — ${count} ${noun} · ${notConfirmed} checks not confirmed`;
-                if ((details.incompleteFiles ?? 0) > 0)
-                    return `lens_diagnostics${scope} — incomplete (${details.incompleteFiles} files not confirmed)`;
-                if (count === 0 && details.unconfirmed)
-                    return details.timedOut
-                        ? `lens_diagnostics${scope} — timed out (result may be incomplete)`
-                        : `lens_diagnostics${scope} — unconfirmed (server cannot confirm clean)`;
-                return `lens_diagnostics${scope} — ${count} ${noun}`;
-            }
-            // Streaming progress partials render the live bar (see scanningSummaryLine)
-            // instead of the details-driven summary, which would show "0 diagnostics"
-            // mid-scan.
-            const scanning = scanningSummaryLine(details, text);
-            if (scanning)
-                return scanning;
-            const mode = details?.mode ?? (typeof args.mode === "string" ? args.mode : "delta");
-            if (isError) {
-                return `lens_diagnostics ${mode} — ${text.split("\n")[0] ?? "error"}`;
-            }
-            // #533: a "clean"/zero render must say so when heavyweight analyzers never
-            // ran this session — a bare "clean" would otherwise misrepresent a cold
-            // cache as a confirmed answer from those analyzers.
-            const coldSuffix = details?.coldRunners && details.coldRunners.length > 0
-                ? ` (${details.coldRunners.length} cold: ${details.coldRunners.join(", ")})`
-                : "";
-            const failedSuffix = details?.failedAnalyzers && details.failedAnalyzers.length > 0
-                ? ` (${details.failedAnalyzers.length} failed: ${details.failedAnalyzers.map((item) => item.id).join(", ")})`
-                : "";
-            if (mode === "delta") {
-                const aw = details?.actionableWarnings ?? 0;
-                const cq = details?.qualityIssues ?? 0;
-                const pd = details?.projectDiagnostics ?? 0;
-                if (aw + cq + pd === 0)
-                    return `lens_diagnostics delta — clean${coldSuffix}${failedSuffix}`;
-                return `lens_diagnostics delta — ${aw} actionable · ${cq} quality · ${pd} project${coldSuffix}${failedSuffix}`;
-            }
-            // #1799: `semantic === "blocking"` iff `severity === "error"` holds for
-            // RAW classification, but not for the rendered counts — a
-            // dependency-drift demotion (#1631, widget-state.ts `isBlocking` vs
-            // `countDiagnostics`) revokes an error's blocking authority (stale)
-            // while the finding itself stays real evidence, so it lands in
-            // `totalErrors` with `totalBlocking` unchanged. That is the one case
-            // where the two totals genuinely disagree, and it must still render —
-            // otherwise a file with drift-demoted errors reads as "clean". What
-            // must NOT happen is printing both terms for the SAME findings (the
-            // actual #1799 bug), so `errors` renders only when `blocking === 0`,
-            // mirroring the per-file row's own guard below.
-            const b = details?.totalBlocking ?? 0;
-            const e = details?.totalErrors ?? 0;
-            const w = details?.totalWarnings ?? 0;
-            // #2414: hint/info tier never contributes to `b + e + w` — a session
-            // with only style opinions is genuinely "clean" of code defects, but
-            // the one-line summary still names the advisory count so it isn't
-            // indistinguishable from a session with zero findings at all.
-            const adv = details?.totalAdvisories ?? 0;
-            const files = details?.filesWithIssues ?? details?.filesChecked ?? 0;
-            if (b + e + w === 0) {
-                const advisorySuffix = adv > 0 ? `, ${adv} hint${adv === 1 ? "" : "s"}` : "";
-                return `lens_diagnostics ${mode} — clean${advisorySuffix} (${files} files)${coldSuffix}${failedSuffix}`;
-            }
-            const parts = [`${b} blocking`];
-            if (b === 0 && e > 0)
-                parts.push(`${e} errors`);
-            parts.push(`${w} warnings`);
-            return `lens_diagnostics ${mode} — ${parts.join(" · ")} (${files} files)${coldSuffix}${failedSuffix}`;
-        }),
-        parameters: Type.Object({
-            source: Type.Optional(Type.String({
-                enum: ["session", "lsp"],
-                description: "Evidence source: session cache (empty cache is not proof of a " +
-                    "clean file — use source=lsp for changed files) or an active LSP probe.",
-            })),
-            scope: Type.Optional(Type.String({
-                enum: ["paths", "workspace"],
-                description: 
-                // #2860: no schema value maps to "current turn's delta" — the
-                // default (omitted scope) already gives that for
-                // source=session, and for source=lsp `delta` was byte-identical
-                // to `paths` (round-2 verify N/F4), so exposing it would only
-                // invite a caller to believe it does something distinct.
-                "Coverage scope: explicit paths, or workspace (default: current turn's delta for source=session).",
-            })),
-            mode: Type.Optional(Type.String({
-                enum: ["delta", "all", "full"],
-                description: "delta = current turn; all = cache-only; full = active LSP scan of paths. Empty cache is not proof of clean.",
-            })),
-            path: Type.Optional(Type.String({
-                description: "One file or directory for source=lsp checks.",
-            })),
-            concurrency: Type.Optional(Type.Number({
-                description: "Source=lsp batch concurrency (maximum 16).",
-            })),
-            waitMs: Type.Optional(Type.Number({
-                description: "Source=lsp per-file wait budget in milliseconds.",
-            })),
-            serverScope: Type.Optional(Type.String({
-                enum: ["primary", "all"],
-                description: "Source=lsp server coverage: primary or all.",
-            })),
-            refreshRunners: Type.Optional(Type.Union([
-                Type.Boolean(),
-                Type.String({ enum: ["cached", "cheap", "all", "none"] }),
-            ], {
-                description: "Analyzer refresh mode for full view.",
-            })),
-            maxProjectFiles: Type.Optional(Type.Number({
-                description: "Project-file limit for cheap runners.",
-            })),
-            maxLspFiles: Type.Optional(Type.Number({
-                description: "File limit for the LSP sweep.",
-            })),
-            includeGenerated: Type.Optional(Type.Boolean({
-                description: "Include generated-name paths in full scans.",
-            })),
-            analysisRoot: Type.Optional(Type.String({
-                description: "Explicit project directory for heavyweight analyzers; it must exist and resolve strictly below the home directory.",
-            })),
-            severity: Type.Optional(Type.String({
-                enum: [...LSP_SEVERITY_FILTERS],
-                description: "Filter by severity threshold (default: all): error shows errors; warning includes errors and warnings; information includes errors, warnings, and information; hint and all show every known tier.",
-            })),
-            paths: Type.Optional(Type.Array(Type.String(), {
-                maxItems: MAX_PATHS_ENTRIES,
-                description: "Files or directories to filter.",
-            })),
-        }),
-        async execute(_toolCallId, params, signal, onUpdate, ctx) {
-            const requestedSource = params.source;
-            const requestedScope = params.scope;
-            const legacyMode = params.mode;
-            const source = requestedSource ?? "session";
-            const scope = requestedScope ??
-                (legacyMode === "delta" || legacyMode === undefined
-                    ? source === "lsp"
-                        ? "paths"
-                        : "delta"
-                    : "workspace");
-            const cwd = ctx.cwd ?? getCwd();
-            if (source === "lsp") {
-                const lspParams = { ...params };
-                delete lspParams.source;
-                delete lspParams.scope;
-                // #2860: explicit `path`/`paths` always win. `scope=workspace`
-                // only supplies a `cwd` default (a full workspace sweep) when the
-                // caller gave NEITHER — it must never override an explicit
-                // narrower request (the #2052 root-eviction hang and the
-                // SKILL.md "check a folder" recipe both depend on this: a
-                // directory `path` under scope=workspace scans that directory,
-                // not the whole project).
-                const hasExplicitPath = typeof lspParams.path === "string" && lspParams.path.length > 0;
-                const hasExplicitPaths = Array.isArray(lspParams.paths) && lspParams.paths.length > 0;
-                if (scope === "workspace" && !hasExplicitPath && !hasExplicitPaths) {
-                    lspParams.path = cwd;
-                }
-                const lspStart = Date.now();
-                const result = (await lspProbe.execute(_toolCallId, lspParams, signal, onUpdate, ctx.signal ? { cwd, signal: ctx.signal } : { cwd }));
-                // #2860 F11: the folded route's own durable trace — without this,
-                // F1's class of defect (a real LSP result rendering as "clean")
-                // leaves no record in latency.log distinguishing source=lsp from
-                // source=session. One record per tool call (not per file), same
-                // convention as the mode=all `blocker_freshness_widget_gate`
-                // phase above.
-                logLatency({
-                    type: "phase",
-                    toolName: "lens_diagnostics",
-                    filePath: cwd,
-                    phase: "lens_diagnostics_lsp_route",
-                    durationMs: Date.now() - lspStart,
-                    metadata: {
-                        scope,
-                        isError: result.isError === true,
-                        totalDiagnostics: result.details?.totalDiagnostics ?? 0,
-                        cleanFiles: result.details?.cleanFiles ?? 0,
-                        unconfirmedFiles: result.details?.unconfirmedFiles ?? 0,
-                        timedOutFiles: result.details?.timedOutFiles ?? 0,
-                    },
-                });
-                return {
-                    ...result,
-                    isError: result.isError === true,
-                    details: { ...result.details, source, scope },
-                };
-            }
-            if (requestedSource !== undefined) {
-                const effectiveMode = legacyMode ??
-                    (scope === "workspace" ? "all" : scope === "paths" ? "all" : "delta");
-                params = { ...params, mode: effectiveMode };
-            }
-            const repaintLspStatus = captureLspStatusRepaint?.(ctx);
-            const mode = params.mode ?? "delta";
-            const severity = params.severity ?? "all";
-            const refreshRunners = params.refreshRunners;
-            const parsePositiveInt = (value) => typeof value === "number" && Number.isFinite(value) && value > 0
-                ? Math.floor(value)
-                : undefined;
-            const maxProjectFiles = parsePositiveInt(params.maxProjectFiles);
-            const maxLspFiles = parsePositiveInt(params.maxLspFiles);
-            const includeGenerated = params.includeGenerated === true;
-            let pathsScope;
-            try {
-                pathsScope = resolvePathsScope(cwd, params.paths);
-            }
-            catch (err) {
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: err instanceof Error ? err.message : String(err),
-                        },
-                    ],
-                    isError: true,
-                    details: { mode, pathsError: true },
-                };
-            }
-            // Escape aborts the agent *turn*, which fires ctx.signal (the turn-wired
-            // abort); the positional signal is the tool-call signal. A registered
-            // extension tool only reliably sees the turn abort via ctx.signal, so honor
-            // BOTH — else a long mode=full scan ignores Escape (the reported bug).
-            const abortSignal = combineAbortSignals(signal, ctx.signal);
-            // Reflect the agent's just-made fixes before reporting: flush pending
-            // per-edit dispatches (re-records fixed files), then drop entries whose
-            // file changed on disk afterwards / was deleted (stale, e.g. external
-            // edits). Together these stop fixed-this-session findings from lingering.
-            await flushPending();
-            const staleDropped = await reconcileStaleWidgetFiles();
-            if (mode === "all") {
-                // #1631 dependency-axis gate for the mode=all store. `reconcileStaleWidgetFiles`
-                // (above) only sees the diagnosed file's OWN mtime; this demotes blocking
-                // findings whose forward imports drifted out-of-band. Paired reconciles, one
-                // read site — the same gate that covers the turn-end inline-blocker store.
-                const dependencyGateStart = Date.now();
-                const { demoted: dependencyDemoted, truncatedImports } = await reconcileStaleWidgetDependencyBlockers(cwd, getRuntime?.()?.turnIndex);
-                logLatency({
-                    type: "phase",
-                    toolName: "lens_diagnostics",
-                    filePath: cwd,
-                    phase: "blocker_freshness_widget_gate",
-                    durationMs: Date.now() - dependencyGateStart,
-                    metadata: {
-                        demoted: dependencyDemoted,
-                        truncatedImports,
-                        surface: "mode=all",
-                    },
-                });
-                return formatAllMode(cwd, severity, undefined, undefined, staleDropped, pathsScope, dependencyDemoted);
-            }
-            if (mode === "full") {
-                // Fold a hard wall-clock ceiling into the abort signal so the scan
-                // always terminates (partial) even if a hung server would otherwise
-                // stall it forever. AbortSignal.timeout aborts with a TimeoutError.
-                const ceiling = AbortSignal.timeout(FULL_SCAN_WALL_CLOCK_MS);
-                const fullSignal = combineAbortSignals(abortSignal, ceiling);
-                // Stream a throttled progress bar: the full scan is opaque for minutes
-                // otherwise.
-                const onProgress = makeProgressReporter(onUpdate);
-                return formatFullMode(cwd, severity, getLspService(), cacheManager, {
-                    refreshRunners,
-                    maxProjectFiles,
-                    maxLspFiles,
-                    includeGenerated,
-                    signal: fullSignal,
-                    wallClockMs: FULL_SCAN_WALL_CLOCK_MS,
-                    onProgress,
-                    onServerReady: repaintLspStatus,
-                    pathsScope,
-                    nextWriteIndex,
-                    runtime: getRuntime?.(),
-                    analysisRoot: typeof params.analysisRoot === "string"
-                        ? params.analysisRoot
-                        : undefined,
-                    host: ctx.host ?? "pi",
-                });
-            }
-            return formatDeltaMode(cacheManager, cwd, severity, pathsScope);
-        },
-    };
-}
-// ── delta mode ────────────────────────────────────────────────────────────────
-function formatProjectDeltaDiagnostic(diagnostic, stale) {
-    // #1944: a demoted row loses the authority marker along with its
-    // coordinate. It kept the 🔴 while its line was replaced by the stale
-    // marker, which is the same "changed the channel, not the body" defect the
-    // turn-end advisory carried — `formatFullMode` (this file, the `d.stale`
-    // arm of its marker) already drops the marker for exactly this reason.
-    const marker = stale
-        ? "○"
-        : diagnostic.semantic === "blocking" || diagnostic.severity === "error"
-            ? "🔴"
-            : "ℹ";
-    const rule = diagnostic.rule ?? diagnostic.code ?? diagnostic.runner;
-    const where = stale ? STALE_LINE_MARKER : `L${diagnostic.line ?? "?"}`;
-    return `  ${marker} ${where}  ${rule}  ${diagnostic.message}`;
-}
-/**
- * #1634 review round R3: `appendProjectDiagnosticsDeltaLines` re-serves the
- * persisted project-diagnostics DELTA report verbatim — the third of
- * `mode=delta`'s three arms (the other two, actionable/quality warnings, were
- * gated in the F3 pass above), and it carried the identical unfixed shape:
- * cited `file:line` findings from a report with its own `generatedAt`, no
- * freshness check. Same gate, same policy as `applyDeltaFreshnessGate`:
- * missing file -> DROP, edited-since -> DEMOTE (loses its line, keeps
- * rule/message), live -> unchanged. See `clients/finding-delivery-gate.ts`
- * surface `lens-diagnostics:mode-delta`.
- */
-function appendProjectDiagnosticsDeltaLines(groups, cwd, report, severity, includeFile) {
-    const scoped = (report?.diagnostics ?? []).filter((diagnostic) => includeFile(diagnostic.filePath) &&
-        matchesSeverity(projectDiagnosticToWidget(diagnostic, diagnostic.filePath), severity));
-    const { "lens-diagnostics-delta-project": gated } = gateFindingsByPathFreshness({
-        cwd,
-        sources: {
-            "lens-diagnostics-delta-project": {
-                findings: scoped,
-                scannedAt: report?.generatedAt,
-                citedPath: (d) => d.filePath,
-                onMissing: "drop",
-            },
-        },
-    });
-    const staleSet = new Set(gated.stale);
-    // Concatenating live-then-stale reorders a file's demoted rows to the end
-    // of its bucket below (rather than each diagnostic's original report
-    // order) — cosmetic only, findings are neither dropped nor duplicated.
-    const diagnostics = [...gated.live, ...gated.stale];
-    const byFile = new Map();
-    for (const diagnostic of diagnostics) {
-        const filePath = path.resolve(diagnostic.filePath);
-        const bucket = byFile.get(filePath) ?? [];
-        bucket.push(diagnostic);
-        byFile.set(filePath, bucket);
-    }
-    for (const [filePath, fileDiagnostics] of byFile) {
-        const group = getDeltaFileGroup(groups, cwd, filePath);
-        for (const diagnostic of fileDiagnostics) {
-            group.projectLines.push(formatProjectDeltaDiagnostic(diagnostic, staleSet.has(diagnostic)));
-        }
-    }
-    return diagnostics.length;
-}
-/**
- * Bounded content memo for {@link applyCachedDispositions}' strict-immediate
- * path: one read per (file revision), not per query. Keyed through
- * `normalizeEphemeralMapKey` (cheap slash-fold + win32-lowercase — these keys
- * are produced and consumed inside this process only) and validated against a
- * fresh stat's mtimeMs+size on every hit, so an edit invalidates without a
- * TTL. Insertion-ordered LRU cap bounds resident source bytes; repeated
- * queries and multi-file reports that cite the same file reuse one read.
- */
-export const CACHED_CONTENT_MEMO_CAP = 64;
-const cachedContentMemo = new BoundedLruCache(CACHED_CONTENT_MEMO_CAP);
-function readContentForAnchors(filePath, stat) {
-    const key = normalizeEphemeralMapKey(filePath);
-    const hit = cachedContentMemo.get(key);
-    if (hit && hit.mtimeMs === stat.mtimeMs && hit.size === stat.size) {
-        return hit.content;
-    }
-    let content;
-    try {
-        content = fsSync.readFileSync(filePath, "utf-8");
-    }
-    catch {
-        return undefined;
-    }
-    cachedContentMemo.set(key, {
-        mtimeMs: stat.mtimeMs,
-        size: stat.size,
-        content,
-    });
-    return content;
-}
-/** #2442 test-only: exercise the bounded content memo (LRU) directly,
- *  without a full lens_diagnostics dispatch. */
-export function _readContentForAnchorsForTests(filePath, stat) {
-    return readContentForAnchors(filePath, stat);
-}
-/**
- * ONE disposition seam for every cache-only lens_diagnostics surface —
- * mode=all summaries, mode=delta's actionable/quality warnings, the delta
- * project-diagnostics report, and the empty-delta carried-over note. Cached
- * findings predate any lens_diagnostic_mark, so each surface must re-apply
- * dispositions at query time; before this seam each site hand-picked its own
- * variant and three of them served stale STRICT false-positive marks via the
- * weak-only filter (a weak filter can never drop a strict-anchored mark, nor
- * any blocking finding — #1625 F1).
- *
- * Strict-immediate path: stat the file once, then compare its mtime against
- * the newest cached diagnostic's own observation stamp through the freshness
- * kernel (`freshnessFromMtime`). Fresh or stamp-less means the current bytes
- * still describe what these findings were observed against, so the content is
- * read (memoized per revision above) and the FULL applyDispositions filter
- * runs — a fresh false-positive mark converges immediately, including on
- * blocking findings.
- *
- * Weak fallback (zero further I/O): a file that is gone/unreadable, or whose
- * mtime moved AFTER these diagnostics were observed. Stale-content edge: the
- * cached findings describe a superseded revision, so their line numbers may no
- * longer align with the lines a mark hashed; deriving strict anchors from the
- * new content could match a DIFFERENT occurrence that merely shares the line
- * number and identical text, so the mark waits for the next real dispatch to
- * re-derive both sides against matching revisions. Weak suppress/defer marks
- * are intent-level and never look at content, so they keep applying here.
- */
-function applyCachedDispositions(cachedDiagnostics, cwd, filePath) {
-    // Zero-I/O fast paths (#1625 F2 precedent): with no marks at all there is
-    // nothing to filter; with only weak suppress/defer marks a strict anchor
-    // can never match, so the weak filter serves them without any stat/read.
-    if (!hasAnyDispositionMarks(cwd))
-        return cachedDiagnostics;
-    if (!hasStrictDispositionMarks(cwd)) {
-        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
-    }
-    let stat;
-    try {
-        stat = fsSync.statSync(filePath);
-    }
-    catch {
-        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
-    }
-    const referenceMs = cachedDiagnostics.reduce((latest, d) => Math.max(latest, d.observedAt ?? 0), 0);
-    if (referenceMs > 0 &&
-        freshnessFromMtime({ mtimeMs: stat.mtimeMs, referenceMs }).verdict ===
-            "stale") {
-        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
-    }
-    const content = readContentForAnchors(filePath, stat);
-    if (content === undefined) {
-        return applyWeakDispositions(cachedDiagnostics, cwd, filePath);
-    }
-    return applyDispositions(cachedDiagnostics, cwd, filePath, content);
-}
-/**
- * #755: drop project-diagnostics-delta findings disposed suppress/defer before
- * delta mode re-serves them. Anchored via `projectDiagnosticToWidget` so the
- * (tool, rule) an agent's mark binds to matches mode=full's own project-runner
- * filter (`applyInlineSuppressionsToSummaries`), keeping the two paths in
- * agreement. Goes through the shared {@link applyCachedDispositions} seam so
- * strict false-positive anchors apply immediately, like every other cache-only
- * surface. Also applies the project's
- * `.pi-lens.json` `rules.<id>.disable`/`select` policy so a project's policy
- * overlays the same delta report cache; the cache is otherwise insensitive to
- * a project-config edit (the per-edit path picks it up immediately, but a
- * non-dispatch tool query would replay the pre-edit state).
- */
-function filterDeltaReportDispositions(report, cwd, policyMap) {
-    if (!report?.diagnostics.length)
-        return report;
-    const kept = report.diagnostics.filter((d) => applyCachedDispositions([projectDiagnosticToWidget(d, d.filePath)], cwd, d.filePath).length === 1);
-    const policyKept = applyRulePolicy(kept, policyMap);
-    if (policyKept.length === report.diagnostics.length)
-        return report;
-    return { ...report, diagnostics: policyKept };
-}
-/**
- * #1634 review round: `formatDeltaMode` re-serves the `actionable-warnings`/
- * `code-quality-warnings` caches verbatim — each cited `file:line`, no
- * freshness check — the SAME shape #1622 fixed for gitleaks/trivy-secrets,
- * unfixed here because `mode=delta` is the tool's DEFAULT and easy to miss
- * in a per-store sweep. Both reports carry a report-level `generatedAt`; a
- * warning is gated against it exactly like a scanner finding against
- * `scannedAt`: missing file → DROP (nothing to fix in a file that's gone),
- * edited-since → DEMOTE (loses its line, keeps its rule/message, marked
- * `STALE_LINE_MARKER`), live → unchanged. See
- * `clients/finding-delivery-gate.ts` surface `lens-diagnostics:mode-delta`.
- */
-function applyDeltaFreshnessGate(files, cwd, generatedAt) {
-    // #2504 review round 4 (F1): an actionable-warnings report is no longer the
-    // product of exactly ONE pass. A deferred off-hook LSP pull upserts its
-    // per-file entries into whatever report is persisted when it lands, so one
-    // report can carry entries observed minutes apart. Judging the older half
-    // against the newer report-level stamp would pass an out-of-band edit made
-    // in between off as live -- exactly the leak this gate exists to stop. Each
-    // distinct stamp is gated on its own; the ordinary single-stamp report
-    // takes one pass, as before, and the original file order is preserved.
-    const stamps = new Set(files.map((file) => file.generatedAt ?? generatedAt ?? ""));
-    if (stamps.size > 1) {
-        const gatedByPath = new Map();
-        for (const stamp of stamps) {
-            const group = files.filter((file) => (file.generatedAt ?? generatedAt ?? "") === stamp);
-            for (const gated of applyDeltaFreshnessGate(group.map((file) => ({
-                filePath: file.filePath,
-                warnings: file.warnings,
-            })), cwd, stamp === "" ? undefined : stamp)) {
-                gatedByPath.set(gated.filePath, gated);
-            }
-        }
-        return files
-            .map((file) => gatedByPath.get(file.filePath))
-            .filter((entry) => entry !== undefined);
-    }
-    // Every entry shares one stamp here; prefer the per-entry one when it has
-    // it, so a merged report's single surviving half is still aged by its own.
-    const stampedAt = [...stamps][0];
-    const effectiveAt = stampedAt !== undefined && stampedAt !== "" ? stampedAt : generatedAt;
-    if (!effectiveAt)
-        return files;
-    const flat = [];
-    for (const file of files) {
-        for (const warning of file.warnings)
-            flat.push({ filePath: file.filePath, warning });
-    }
-    if (flat.length === 0)
-        return files;
-    const { "lens-diagnostics-delta": gated } = gateFindingsByPathFreshness({
-        cwd,
-        sources: {
-            "lens-diagnostics-delta": {
-                findings: flat,
-                scannedAt: effectiveAt,
-                citedPath: (f) => f.filePath,
-                onMissing: "drop",
-            },
-        },
-    });
-    // Two passes (live, then stale) reorder a file's demoted rows to the end
-    // of its warnings array rather than the original report order — cosmetic
-    // only, nothing is dropped or duplicated.
-    const byFile = new Map();
-    for (const f of gated.live) {
-        const arr = byFile.get(f.filePath) ?? [];
-        arr.push(f.warning);
-        byFile.set(f.filePath, arr);
-    }
-    for (const f of gated.stale) {
-        const arr = byFile.get(f.filePath) ?? [];
-        // Fix B (#3167): carry the stamp the row was judged against so the render
-        // can emit one age label per file group — the row's own observation stamp,
-        // not the report-level one (the #2504 r4 multi-stamp case).
-        arr.push({
-            ...f.warning,
-            stale: true,
-            line: undefined,
-            staleAsOf: effectiveAt,
-        });
-        byFile.set(f.filePath, arr);
-    }
-    return files
-        .map((file) => ({
-        filePath: file.filePath,
-        warnings: byFile.get(file.filePath) ?? [],
-    }))
-        .filter((file) => file.warnings.length > 0);
-}
-function getDeltaFileGroup(groups, cwd, filePath) {
-    const rel = path.relative(cwd, filePath);
-    let group = groups.get(rel);
-    if (!group) {
-        group = {
-            rel,
-            actionableLines: [],
-            qualityLines: [],
-            projectLines: [],
-            incomplete: false,
-        };
-        groups.set(rel, group);
-    }
-    return group;
-}
-// @delivery-surface: lens-diagnostics:mode-delta
-function formatDeltaMode(cacheManager, cwd, severity, pathsScope) {
-    const actionableEntry = cacheManager.readCache("actionable-warnings", cwd);
-    const qualityEntry = cacheManager.readCache("code-quality-warnings", cwd);
-    // #3170: files whose re-verify pass could not complete inside its budget —
-    // their rows render as carried, plus this explicit gap label (never a
-    // false clean). Computed from the RAW actionable-warnings cache entries
-    // because the freshness pipeline below rebuilds the file shape. The
-    // re-verify only ever writes the actionable-warnings cache — the quality
-    // report's file shape carries no such marker.
-    const reverifyIncompletePaths = new Set((actionableEntry?.data?.files ?? [])
-        .filter((file) => file.reVerifyIncomplete)
-        .map((file) => normalizeMapKey(file.filePath)));
-    const actionable = actionableEntry?.data;
-    const quality = qualityEntry?.data;
-    // Project rule policy (`.pi-lens.json` `rules.<id>.disable` /
-    // `rules.<id>.select`) — output-only filtering applied consistently across
-    // every mode. The cache-only delta/all paths would otherwise leak project-
-    // policy oversight (the per-edit dispatch already filters, but the cache
-    // snapshots predate the user's project config edit and would replay
-    // filtered findings). Weak-anchored like weak disposition — zero I/O.
-    const policyMap = loadProjectRulePolicyMap(cwd);
-    const projectDelta = filterDeltaReportDispositions(loadProjectDiagnosticsDeltaReport(cwd), cwd, policyMap);
-    const includeFile = createScopedFileFilter(cwd, pathsScope);
-    // #755: delta re-serves the actionable/quality caches verbatim, but those
-    // were filtered at DISPATCH time — before any lens_diagnostic_mark. Re-apply
-    // dispositions here so a mark converges immediately, not only on the next
-    // edit — through the shared {@link applyCachedDispositions} seam, so strict
-    // false-positive marks land as fast as suppress/defer.
-    const visibleWarningFiles = (files) => (files ?? [])
-        .filter((file) => includeFile(file.filePath))
-        .map((file) => ({
-        filePath: file.filePath,
-        // #2504 r4 (F1): carried through, so a merged report's older
-        // entries keep their own age all the way to the freshness gate.
-        generatedAt: file.generatedAt,
-        warnings: applyRulePolicy(applyCachedDispositions(file.warnings ?? [], cwd, file.filePath), policyMap),
-    }))
-        .filter((file) => file.warnings.length > 0);
-    const actionableFiles = applyDeltaFreshnessGate(visibleWarningFiles(actionable?.files), cwd, actionable?.generatedAt);
-    const qualityFiles = applyDeltaFreshnessGate(visibleWarningFiles(quality?.files), cwd, quality?.generatedAt);
-    const matchingWarnings = (warnings) => warnings.filter((warning) => matchesRecordSeverity(warning.severity, severity));
-    const filteredActionableFiles = actionableFiles
-        .map((file) => ({
-        ...file,
-        warnings: matchingWarnings(file.warnings),
-    }))
-        .filter((file) => file.warnings.length > 0);
-    const filteredQualityFiles = qualityFiles
-        .map((file) => ({
-        ...file,
-        warnings: matchingWarnings(file.warnings),
-    }))
-        .filter((file) => file.warnings.length > 0);
-    // #3196: one grouping pass keyed by file — every tier below appends into
-    // the SAME per-file group (see `DeltaFileGroup`/`getDeltaFileGroup`), so a
-    // file present in more than one report always renders its rows under its
-    // own header, wherever that header ends up in the final buffer.
-    const groups = new Map();
-    // Fixable warnings from actionable-warnings and quality cache entries retain
-    // their own severity tier. Apply the same threshold semantics as the LSP path.
-    // F5/F10 (#3168): at most ONE label group (age and/or #3170's re-verify
-    // gap) per file. The actionable tier is folded first, so its stale row (if
-    // any) wins the group's age label; the quality tier only supplies one when
-    // the actionable tier had none for that file (#3168 F10(c)'s quality-only
-    // shape). The `(re-verify incomplete)` flag is a fact about the file (from
-    // the raw actionable cache, independent of which tier's rows happen to
-    // render it), so it is recorded on the group the first time either tier
-    // touches that file and never predicted.
-    if (filteredActionableFiles.length > 0) {
-        for (const file of filteredActionableFiles) {
-            const group = getDeltaFileGroup(groups, cwd, file.filePath);
-            for (const w of file.warnings) {
-                const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-                group.actionableLines.push(`  ⚠ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
-            }
-            const key = normalizeMapKey(file.filePath);
-            if (reverifyIncompletePaths.has(key))
-                group.incomplete = true;
-            if (!group.staleRow) {
-                const staleWarning = file.warnings.find((w) => w.stale);
-                if (staleWarning)
-                    group.staleRow = { staleAsOf: staleWarning.staleAsOf };
-            }
-        }
-    }
-    // Quality issues
-    if (filteredQualityFiles.length > 0) {
-        for (const file of filteredQualityFiles) {
-            const group = getDeltaFileGroup(groups, cwd, file.filePath);
-            for (const w of file.warnings) {
-                const where = w.stale ? STALE_LINE_MARKER : `L${w.line ?? "?"}`;
-                group.qualityLines.push(`  ℹ ${where}  ${w.rule ?? w.code ?? w.tool}  ${w.message}`);
-            }
-            const key = normalizeMapKey(file.filePath);
-            if (reverifyIncompletePaths.has(key))
-                group.incomplete = true;
-            if (!group.staleRow) {
-                const staleWarning = file.warnings.find((w) => w.stale);
-                if (staleWarning)
-                    group.staleRow = { staleAsOf: staleWarning.staleAsOf };
-            }
-        }
-    }
-    const projectDeltaCount = appendProjectDiagnosticsDeltaLines(groups, cwd, projectDelta, severity, includeFile);
-    const lines = [];
-    for (const group of groups.values()) {
-        lines.push(group.rel);
-        lines.push(...group.actionableLines);
-        lines.push(...group.qualityLines);
-        lines.push(...group.projectLines);
-        if (group.staleRow) {
-            lines.push(`  (${formatCacheAgeLabel(group.staleRow.staleAsOf)})`);
-        }
-        if (group.incomplete)
-            lines.push("  (re-verify incomplete)");
-    }
-    const selectedActionableFiles = filteredActionableFiles;
-    const selectedQualityFiles = filteredQualityFiles;
-    const aw = selectedActionableFiles.reduce((count, file) => count + file.warnings.length, 0);
-    const cq = selectedQualityFiles.reduce((count, file) => count + file.warnings.length, 0);
-    if (lines.length === 0) {
-        let text = `No ${severity === "all" ? "" : severity + " "}issues in the current turn delta.`;
-        // Discoverability (#190): `delta` is current-turn-scoped, so it's empty
-        // right after a resume even when prior findings were rehydrated into the
-        // session-wide view. Point the agent at `mode=all` when that's the case.
-        const carried = getFileDiagnosticSummaries()
-            .filter((f) => includeFile(f.filePath))
-            .map((f) => ({
-            ...f,
-            diagnostics: applyRulePolicy(applyCachedDispositions(f.diagnostics, cwd, f.filePath), policyMap),
-        }))
-            .filter((f) => f.diagnostics.length > 0);
-        const carriedIssues = carried.reduce((n, f) => n + f.diagnostics.length, 0);
-        if (carried.length > 0) {
-            text += ` ${carriedIssues} finding${carriedIssues === 1 ? "" : "s"} across ${carried.length} file${carried.length === 1 ? "" : "s"} carried over from earlier this session — use mode=all to see them.`;
-        }
-        text += pathsScopeCacheOnlyNote(pathsScope);
-        return {
-            content: [{ type: "text", text }],
-            details: { mode: "delta", warnings: 0, carriedOverFiles: carried.length },
-        };
-    }
-    const summary = `\nSummary (turn delta): ${aw} actionable warning${aw === 1 ? "" : "s"} · ${cq} quality issue${cq === 1 ? "" : "s"} · ${projectDeltaCount} project diagnostic${projectDeltaCount === 1 ? "" : "s"}`;
-    return {
-        content: [{ type: "text", text: lines.join("\n") + summary }],
-        details: {
-            mode: "delta",
-            actionableWarnings: aw,
-            qualityIssues: cq,
-            projectDiagnostics: projectDeltaCount,
-        },
-    };
-}
-// ── all mode ──────────────────────────────────────────────────────────────────
-function createCurrentIgnoreFilter(cwd) {
-    try {
-        const matcher = getProjectIgnoreMatcher(cwd);
-        return (filePath) => !matcher.isIgnored(path.resolve(filePath), false);
-    }
-    catch {
-        // Diagnostics should remain available even if an ignore config/root probe is
-        // temporarily unreadable. Walkers already treat config load failures as
-        // non-fatal; match that behavior for cached diagnostic presentation.
-        return () => true;
-    }
-}
-/**
- * Resolves the `paths` param into a scope predicate. Returns `undefined` when
- * `paths` was not provided (callers fall back to no restriction). Throws a
- * plain `Error` when the cap is exceeded — the caller turns that into a
- * clear tool error rather than silently truncating (a wrapper must not
- * believe it checked files it didn't).
- */
-function resolvePathsScope(cwd, rawPaths) {
-    if (!Array.isArray(rawPaths) || rawPaths.length === 0)
-        return undefined;
-    if (rawPaths.length > MAX_PATHS_ENTRIES) {
-        throw new Error(`paths has ${rawPaths.length} entries, over the ${MAX_PATHS_ENTRIES} cap. ` +
-            "Narrow the list or omit paths to scan without a restriction.");
-    }
-    const entries = rawPaths
-        .filter((entry) => typeof entry === "string" && entry.trim().length > 0)
-        .map((entry) => path.resolve(path.isAbsolute(entry) ? entry : path.resolve(cwd, entry)));
-    const missing = [];
-    const fileEntries = [];
-    const existingEntries = [];
-    const dirEntries = [];
-    for (const entry of entries) {
-        let stat;
-        try {
-            stat = fsSync.statSync(entry);
-        }
-        catch {
-            // Nonexistent on disk right now — still treated as a file-key match
-            // candidate for the delta/all cache filter (not just dropped): the
-            // wrapper use case passes git output, where a deleted-but-staged path
-            // legitimately has no on-disk file yet may still have cached findings
-            // from before deletion. Excluded from `existingEntries` (nothing to
-            // actively scan) and recorded in `missing` for mode=full's skipped-note.
-            missing.push(entry);
-            fileEntries.push(entry);
-            continue;
-        }
-        if (stat.isDirectory()) {
-            dirEntries.push(entry);
-        }
-        else {
-            fileEntries.push(entry);
-            existingEntries.push(entry);
-        }
-    }
-    const fileKeys = new Set(fileEntries.map((f) => normalizeFilePath(f)));
-    const dirPrefixes = dirEntries.map((d) => normalizeFilePath(d));
-    const includeExplicitFile = (filePath) => fileKeys.has(normalizeFilePath(path.resolve(filePath)));
-    const includeFile = (filePath) => {
-        const key = normalizeFilePath(path.resolve(filePath));
-        if (fileKeys.has(key))
-            return true;
-        return dirPrefixes.some((prefix) => key === prefix || key.startsWith(`${prefix}/`));
-    };
-    return {
-        includeFile,
-        includeExplicitFile,
-        missing,
-        existingEntries,
-        hasDirectoryEntries: dirEntries.length > 0,
-    };
-}
-/** Short, honest note for delta/all when `paths` filtered everything out — these modes are cache-only, so an unseen file legitimately shows nothing. */
-function pathsScopeCacheOnlyNote(scope) {
-    if (!scope)
-        return "";
-    return ("\n\nNote: paths restricts this to cached findings for files pi-lens has " +
-        "already dispatched this session — mode=delta/all can't see files it " +
-        "hasn't touched. Use mode=full to actively scan exactly these paths.");
-}
-/** Short note listing paths entries that don't exist on disk (mode=full only — the wrapper use case passes git output, where a deleted-but-staged file WILL appear). */
-function pathsScopeMissingNote(scope) {
-    if (!scope || scope.missing.length === 0)
-        return "";
-    const shown = scope.missing.slice(0, 10).map((p) => path.basename(p));
-    const more = scope.missing.length > shown.length
-        ? ` (+${scope.missing.length - shown.length} more)`
-        : "";
-    return `\n\n⚠ Skipped ${scope.missing.length} path(s) not found on disk: ${shown.join(", ")}${more}`;
-}
-function createScopedFileFilter(cwd, pathsScope) {
-    const ignoreFile = createCurrentIgnoreFilter(cwd);
-    return (filePath) => {
-        if (!pathsScope)
-            return ignoreFile(filePath);
-        if (!pathsScope.includeFile(filePath))
-            return false;
-        return pathsScope.includeExplicitFile(filePath) || ignoreFile(filePath);
-    };
-}
-function filterProjectDiagnosticsSnapshot(snapshot, includeFile) {
-    if (!snapshot)
-        return undefined;
-    return {
-        ...snapshot,
-        diagnostics: snapshot.diagnostics.filter((d) => includeFile(d.filePath)),
-    };
-}
-function filterProjectDiagnosticsDeltaReport(report, includeFile) {
-    if (!report)
-        return undefined;
-    return {
-        ...report,
-        diagnostics: report.diagnostics.filter((d) => includeFile(d.filePath)),
-    };
-}
-/**
- * Apply the project rule policy to a project-diagnostics snapshot/delta
- * report's `diagnostics` list, in place of the collection's shape. Used by
- * `formatFullMode` so `projectSnapshot.diagnostics.length` /
- * `projectDelta.diagnostics.length` — which feed both the merged summaries
- * and the `details.projectDiagnostics`/`details.projectDiagnosticsDelta`
- * counts — already reflect the policy instead of reporting a pre-policy
- * count that disagrees with the rendered text.
- */
-function applyProjectRulePolicy(value, policyMap) {
-    if (!value)
-        return undefined;
-    return {
-        ...value,
-        diagnostics: applyRulePolicy(value.diagnostics, policyMap),
-    };
-}
-/** A diagnostic counts as error-like when it blocks or has error severity.
- * A `stale` (#1641 past-EOF) entry is excluded — its cited line no longer
- * exists in the current file, so it can no longer count toward a hard stop. */
-function isErrorLike(d) {
-    if (d.stale)
-        return false;
-    return d.semantic === "blocking" || d.severity === "error";
-}
-function matchesSeverity(d, severity) {
-    return matchesRecordSeverity(isErrorLike(d) ? "error" : d.severity, severity);
-}
-function matchesRecordSeverity(recordSeverity, requested) {
-    if (requested === "all")
-        return true;
-    if (requested === "error")
-        return recordSeverity === "error";
-    if (requested === "warning")
-        return recordSeverity === "error" || recordSeverity === "warning";
-    if (requested === "information")
-        return (recordSeverity === "error" ||
-            recordSeverity === "warning" ||
-            recordSeverity === "info" ||
-            recordSeverity === "note" ||
-            recordSeverity === "help");
-    if (requested === "hint")
-        return (recordSeverity === "error" ||
-            recordSeverity === "warning" ||
-            recordSeverity === "info" ||
-            recordSeverity === "note" ||
-            recordSeverity === "help" ||
-            recordSeverity === "hint");
-    return true;
-}
-/** Most-important first: blocking → error → warning/other, then by line. */
-function severityRank(d) {
-    if (d.semantic === "blocking")
-        return 0;
-    if (d.severity === "error")
-        return 1;
-    if (d.severity === "warning")
-        return 2;
-    return 3;
-}
-function bySeverityThenLine(a, b) {
-    return severityRank(a) - severityRank(b) || (a.line ?? 0) - (b.line ?? 0);
-}
-function lspSeverityName(severity) {
-    if (severity === 1)
-        return "error";
-    if (severity === 2)
-        return "warning";
-    if (severity === 3)
-        return "info";
-    return "hint";
-}
-function lspRuleId(diagnostic) {
-    const code = diagnostic.code === undefined ? undefined : String(diagnostic.code);
-    if (diagnostic.source && code)
-        return `${diagnostic.source}:${code}`;
-    return diagnostic.source ?? code ?? "lsp";
-}
-function lspDiagnosticToWidget(diagnostic) {
-    const severity = lspSeverityName(diagnostic.severity);
-    const rule = lspRuleId(diagnostic);
-    return {
-        severity,
-        semantic: diagnostic.severity === 1 ? "blocking" : "warning",
-        message: diagnostic.message,
-        line: diagnostic.range.start.line + 1,
-        col: diagnostic.range.start.character + 1,
-        rule,
-        // #3041: keep auxiliary provenance. The footer-reconcile loop above already
-        // gives a swept aux finding its real tool id via `retagAuxiliaryDiagnostics`
-        // (#692); this second conversion of the SAME raw diagnostics did not, and
-        // dispositions are anchored by `tool` — so a `false-positive`/`suppress`
-        // mark recorded against the per-edit `ast-grep` finding never matched the
-        // `lsp`-labelled copy mode=full renders.
-        tool: findAuxiliaryProfileForSource(diagnostic.source)?.tool ?? "lsp",
-    };
-}
-function projectDiagnosticToWidget(diagnostic, filePath) {
-    return {
-        severity: diagnostic.severity,
-        semantic: diagnostic.semantic,
-        message: diagnostic.message,
-        line: diagnostic.line,
-        col: diagnostic.column,
-        rule: diagnostic.rule ?? diagnostic.code,
-        tool: diagnostic.runner || diagnostic.tool,
-        uri: widgetDiagnosticUri(filePath, diagnostic.line, diagnostic.column),
-    };
-}
-// The ast-grep LSP keys its diagnostics `rule = "ast-grep:<id>"` (source:code,
-// lsp-diagnostics.ts), while the napi runner — per-edit AND the project scan
-// (#308) — emits the bare `<id>`. Both run the same shipped ruleset, so the same
-// violation must collapse to one finding in mode=full's merge regardless of which
-// engine produced it. Strip the `ast-grep:` source prefix and the `-js` language
-// suffix (the napi runner already treats `<id>` / `<id>-js` as one rule) so the
-// LSP sweep and the napi scan don't double-report the same line. The
-// normalization itself now lives in `clients/dispatch/rule-id-normalize.ts` so the
-// inline suppression parser, the project rule-policy matcher, and dedup all apply
-// the same canonical form.
-function diagnosticDedupKey(filePath, diagnostic) {
-    const ruleId = normalizeRuleId(diagnostic.rule ?? diagnostic.tool ?? "");
-    return [path.resolve(filePath), diagnostic.line ?? "?", ruleId].join(":");
-}
-/**
- * Which project runner produced a retained row (#2154). ONE derivation, used by
- * both the retirement filter and the record that counts what it retired — v2's
- * N2 was two verbatim copies of this expression drifting apart.
- */
-function runnerIdOf(diagnostic) {
-    return diagnostic.tool ?? diagnostic.rule?.split(":", 1)[0] ?? "";
-}
-/**
- * The one project-runner retirement decision. Coverage is authoritative when
- * present for the runner; the older id-only arm is used only when the runner
- * declared no coverage at all.
- *
- * #2962: an entry with an EMPTY file set is a declaration, not a missing one —
- * "this producer analysed the root and proved zero files". Selecting it out by
- * its own size (the pre-#2962 `entry.files.size > 0` filter) dropped it into the
- * whole-root id-only arm, so one complete opengrep report with
- * `paths.scanned: []` retired every retained opengrep finding in the tree even
- * though no file had been scanned. The id-only arm is unchanged for the eight
- * runners that declare no coverage.
- */
-export function runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeCoverage) {
-    const runnerId = runnerIdOf(diagnostic);
-    const coverage = (authoritativeCoverage ?? []).filter((entry) => entry.runnerId === runnerId);
-    if (coverage.length === 0) {
-        return authoritativeRunnerIds?.has(runnerId) ? "retire" : "keep";
-    }
-    const realFilePath = realpathOrResolve(filePath);
-    for (const entry of coverage) {
-        const root = entry.root;
-        const relative = path.relative(root, realFilePath);
-        const underRoot = relative === "" ||
-            (!relative.startsWith("..") && !path.isAbsolute(relative));
-        if (!underRoot)
-            continue;
-        if (entry.files.has(realFilePath)) {
-            return "retire";
-        }
-    }
-    return "keep";
-}
-function summarizeDiagnostics(filePath, diagnostics, hasFinalSnapshot) {
-    let blocking = 0;
-    let errors = 0;
-    let warnings = 0;
-    let advisories = 0;
-    for (const diagnostic of diagnostics) {
-        // #1641: a demoted past-EOF entry keeps its severity for display but
-        // drops out of the tallies — same reasoning as widget-state's `isBlocking`.
-        if (diagnostic.stale)
-            continue;
-        if (diagnostic.semantic === "blocking")
-            blocking++;
-        // #2414: severity → tier classification is shared with
-        // `countDiagnostics`/`countAdvisories` in `clients/widget-state.ts` via
-        // `classifyDiagnosticTier` — mode=all reads that store's tally and
-        // mode=full reads this one, so the two must agree. `hint`/`info` no
-        // longer inflate `warnings` (they used to, matching a pre-#2414
-        // `countDiagnostics`, so a hint-only file scored 0/0/0 there too and the
-        // `withIssues` filter below dropped it — that gap is now closed via
-        // `advisories`, not by re-folding hints into `warnings`).
-        const tier = classifyDiagnosticTier(diagnostic);
-        if (tier === "error")
-            errors++;
-        else if (tier === "warning")
-            warnings++;
-        else if (tier === "advisory")
-            advisories++;
-    }
-    return {
-        filePath,
-        blocking,
-        errors,
-        warnings,
-        advisories,
-        hasFinalSnapshot,
-        diagnostics,
-    };
-}
-// #1618: sentence form used when exactly one reason accounts for every
-// unconfirmed file — mirrors the pre-#1618 two-case ternary's phrasing so
-// existing single-reason callers see unchanged text.
-const UNCONFIRMED_REASON_SENTENCE = {
-    budget: "check didn't complete within budget",
-    inconclusive: "check was inconclusive (notify-write or diagnostics wait timed out)",
-    coverage_gap: "an auxiliary scanner coverage gap",
-    service_destroyed: "the LSP service was reset mid-sweep",
-    error: "check errored",
-    // #1618 review round 2: the LSP layer considered this touch CONFIRMED —
-    // the file's content changed under it (stale binding), which is a
-    // completely different failure from a timeout. Must never collapse into
-    // "within budget", the exact string this PR exists to stop misrendering.
-    binding_mismatch: "the file changed on disk since this result was computed",
-    // #2052: no server was asked. Say WHY and say it is permanent for this
-    // path, so the reader does not read an empty result as "clean" or retry it.
-    outside_project_root: "the file is outside every initialized session project root, so no language server was asked",
-};
-// Short per-reason label used only when MORE than one reason is present, so
-// the note can still say "N timed out, M errored" instead of collapsing to
-// one sentence that can't carry two counts.
-const UNCONFIRMED_REASON_COUNT_LABEL = {
-    budget: "timed out",
-    inconclusive: "inconclusive",
-    coverage_gap: "coverage gap",
-    service_destroyed: "service reset mid-sweep",
-    error: "errored",
-    binding_mismatch: "stale binding",
-    outside_project_root: "outside project root",
-};
-/**
- * #1618: a result predating the `unconfirmedReason` field (a legacy/test
- * double, or `LSPWorkspaceDiagnosticResult`'s own pre-#1618 shape) is
- * classified from its OTHER fields exactly the way the dead
- * `unconfirmedErrored = length - unconfirmedTimedOut` subtraction meant to,
- * before that subtraction was structurally always 0 (the sweep's catch
- * block sets both `error` and `timedOut`, so `unconfirmedErrored` never had
- * a way to become nonzero). An explicit `result.error` now wins even when
- * `unconfirmedReason` is absent, so an errored file is never rendered as
- * "within budget".
- *
- * #1618 review round 2: `mismatched` MUST be checked first. A binding
- * mismatch is discovered HERE, after the sweep already returned the result
- * as confirmed (`!timedOut`, no `.error`, no `.unconfirmedReason`) — the
- * `?? "budget"` fallback below would otherwise silently claim a
- * stale-binding file as "within budget", the exact string this PR exists to
- * stop misrendering.
- */
-function classifyUnconfirmedReason(result, mismatched) {
-    if (mismatched.has(result))
-        return "binding_mismatch";
-    return result.unconfirmedReason ?? (result.error ? "error" : "budget");
-}
-/**
- * #1618: replaces the `unconfirmedTimedOut`/`unconfirmedErrored` dead
- * subtraction with a real per-reason tally read off each result's own
- * `unconfirmedReason` (falling back to `classifyUnconfirmedReason` for a
- * legacy result that predates the field). `mismatched` is threaded through
- * so a stale-binding file is never counted under a fallback reason it
- * doesn't have (review round 2).
- */
-function tallyUnconfirmedReasons(results, mismatched) {
-    const tally = new Map();
-    for (const result of results) {
-        const reason = classifyUnconfirmedReason(result, mismatched);
-        tally.set(reason, (tally.get(reason) ?? 0) + 1);
-    }
-    return tally;
-}
-/** Render `tallyUnconfirmedReasons`' output as the clause inside the
- *  "unconfirmed (...)" note — a single sentence when one reason accounts for
- *  everything, else a comma-joined "N label" breakdown. */
-function formatUnconfirmedReasonClause(tally) {
-    const entries = [...tally.entries()].filter(([, count]) => count > 0);
-    if (entries.length === 0)
-        return "";
-    if (entries.length === 1) {
-        return UNCONFIRMED_REASON_SENTENCE[entries[0][0]];
-    }
-    return entries
-        .map(([reason, count]) => `${count} ${UNCONFIRMED_REASON_COUNT_LABEL[reason]}`)
-        .join(", ");
-}
-/**
- * #646: break the confirmed/unconfirmed LSP-sweep tally down PER primary
- * server id (typescript, pyright, marksman, ...) instead of one flat
- * aggregate count. Mirrors `tools/lsp-diagnostics.ts`'s `primaryServerId`/
- * `tallyConfirmation` split — both tools now use the SAME
- * `primaryServerId` (clients/lsp/config.ts) so a file's classification as
- * "primary language server" vs "auxiliary scanner" agrees between them.
- *
- * Motivating case (#646): a real sweep came back 34/155 unconfirmed, and
- * diagnosing WHICH server was responsible required grepping
- * `~/.pi-lens/latency.log` by hand — it turned out to be 100% one push-only
- * server (marksman). This tally makes that visible directly: `{ marksman:
- * { confirmed: 0, total: 34 }, typescript: { confirmed: 121, total: 121 } }`.
- *
- * Purely an additional reporting dimension — does NOT change what counts as
- * confirmed/unconfirmed (the existing `confirmedLspResults`/
- * `unconfirmedLspResults` partition in `formatFullMode` is unchanged and
- * still the source of truth this reads from).
- */
-function tallyLspByPrimaryServer(confirmed, unconfirmed) {
-    const byServer = new Map();
-    const bump = (filePath, wasConfirmed) => {
-        const id = primaryServerId(filePath) ?? "unknown";
-        const entry = byServer.get(id) ?? { confirmed: 0, total: 0 };
-        entry.total += 1;
-        if (wasConfirmed)
-            entry.confirmed += 1;
-        byServer.set(id, entry);
-    };
-    for (const result of confirmed)
-        bump(result.filePath, true);
-    for (const result of unconfirmed)
-        bump(result.filePath, false);
-    return byServer;
-}
-/**
- * Render the per-server tally from `tallyLspByPrimaryServer` as a short
- * clause, e.g. "typescript: 121/121, marksman: 0/34" — sorted so the
- * worst-confirmed server (the one most likely to be why a sweep looks
- * unconfirmed) is called out first.
- */
-function formatLspServerBreakdown(byServer) {
-    return [...byServer.entries()]
-        .sort((a, b) => {
-        const rateA = a[1].confirmed / a[1].total;
-        const rateB = b[1].confirmed / b[1].total;
-        return rateA - rateB;
-    })
-        .map(([id, { confirmed, total }]) => `${id}: ${confirmed}/${total}`)
-        .join(", ");
-}
-/**
- * #646: split a raw LSP-sweep result set's diagnostics into "primary" (the
- * real language server, e.g. typescript/pyright) vs "auxiliary" (cross-
- * cutting scanners attached via clientScope "all" — ast-grep, opengrep,
- * zizmor, typos, marksman, ...), the same separation `lsp_diagnostics`
- * already applies to its own findings rendering (see
- * `tools/lsp-diagnostics.ts`'s `collectBatchDiagnostics`). Computed from the
- * raw per-file LSP results (not the merged widget-state summaries further
- * down `formatFullMode`) so it doesn't disturb the existing merge/dedup
- * logic those summaries feed into.
- */
-function tallyLspPrimaryVsAuxiliary(results) {
-    let primary = 0;
-    let auxiliary = 0;
-    for (const result of results) {
-        const primaryId = primaryServerId(result.filePath);
-        for (const diagnostic of result.diagnostics ?? []) {
-            if (diagnostic.serverId === primaryId)
-                primary += 1;
-            else
-                auxiliary += 1;
-        }
-    }
-    return { primary, auxiliary };
-}
-function mergeDiagnosticsWithWidgetSummaries(widgetSummaries, lspResults, projectSnapshot, projectDelta, 
-/**
- * #1993: resolved paths covered by a CONFIRMED, fully-covered LSP result
- * in `lspResults`. The fresh sweep is AUTHORITATIVE for these files - any
- * widget-store diagnostics seeded for them predate the sweep and must not
- * survive it (an additive-only merge let mid-edit stale 🔴 entries render
- * forever beside a clean sweep). Files absent from this set keep today's
- * additive behavior (fail-open: unconfirmed/timed-out sweeps never retire
- * widget state they did not actually re-check).
- */
-authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage) {
-    const byFile = new Map();
-    const seen = new Set();
-    for (const summary of widgetSummaries) {
-        const filePath = path.resolve(summary.filePath);
-        // NOTE (#1993 review): dispositions recorded against a CACHED copy's
-        // message text may not match this file's fresh sweep copy (weak
-        // anchors key on message). Both copies derive from the same LSP
-        // diagnostic via convertLspDiagnostics, so identity is stable in
-        // practice; inline pi-lens-ignore comments are the primary
-        // suppression mechanism.
-        if (authoritativeLspFiles?.has(filePath))
-            continue;
-        const retained = summary.diagnostics ?? [];
-        const diagnostics = retained
-            .filter((diagnostic) => runnerRetirementDecision(diagnostic, filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) !== "retire")
-            .map((d) => ({ ...d }));
-        byFile.set(filePath, 
-        // #2154 v4: when the filter retires rows, the stored tallies describe
-        // diagnostics that are no longer delivered — full mode rendered
-        // `main.go 1W … 1 warning` with no row under it. Recompute from what
-        // survived, and only then (an untouched file keeps its own counts).
-        diagnostics.length === retained.length
-            ? { ...summary, filePath, diagnostics }
-            : summarizeDiagnostics(filePath, diagnostics, summary.hasFinalSnapshot ?? true));
-        for (const diagnostic of diagnostics) {
-            seen.add(diagnosticDedupKey(filePath, diagnostic));
-        }
-    }
-    const addDiagnostic = (filePath, widgetDiagnostic) => {
-        const existing = byFile.get(filePath);
-        const diagnostics = existing ? [...existing.diagnostics] : [];
-        const key = diagnosticDedupKey(filePath, widgetDiagnostic);
-        if (seen.has(key))
-            return;
-        seen.add(key);
-        diagnostics.push(widgetDiagnostic);
-        byFile.set(filePath, summarizeDiagnostics(filePath, diagnostics, existing?.hasFinalSnapshot ?? true));
-    };
-    for (const result of lspResults) {
-        const filePath = path.resolve(result.filePath);
-        for (const diagnostic of result.diagnostics ?? []) {
-            addDiagnostic(filePath, lspDiagnosticToWidget(diagnostic));
-        }
-    }
-    for (const diagnostic of projectSnapshot?.diagnostics ?? []) {
-        addDiagnostic(path.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
-    }
-    for (const diagnostic of projectDelta?.diagnostics ?? []) {
-        addDiagnostic(path.resolve(diagnostic.filePath), projectDiagnosticToWidget(diagnostic, diagnostic.filePath));
-    }
-    return [...byFile.values()];
-}
-/**
- * Apply inline `pi-lens-ignore` suppression to the merged mode=full summaries so
- * the project-wide sweep honors the same comments as the per-edit path (#442) —
- * without it, a site cleanly suppressed in mode=all reappears as blocking here.
- * Reads each flagged file once (bounded to files that actually have diagnostics);
- * a read failure is fail-safe (keep the diagnostics rather than hide a finding on
- * an I/O error). Re-summarizes so the blocking/error/warning counts reflect the
- * suppression.
- *
- * Also applies the project's `.pi-lens.json` `rules.<id>.disable`/`select`
- * policy AFTER inline suppression / disposition so the same set of findings
- * the per-edit `dispatcher.ts` filters is what's rendered here. The policy
- * map is passed in (computed once per `formatFullMode` call) rather than
- * re-deriving per file — see `loadProjectRulePolicyMap(cwd)`.
- */
-async function applyInlineSuppressionsToSummaries(summaries, cwd, policyMap) {
-    return Promise.all(summaries.map(async (summary) => {
-        if (!summary.diagnostics.length)
-            return summary;
-        let content;
-        try {
-            content = await fs.readFile(summary.filePath, "utf8");
-        }
-        catch {
-            // Inline suppression/disposition remains fail-open when the file cannot
-            // be read, but project policy does not depend on content and must still
-            // be applied so a fresh full-mode result cannot bypass `disable`/`select`.
-            const policyKept = applyRulePolicy(summary.diagnostics, policyMap);
-            return policyKept.length === summary.diagnostics.length
-                ? summary
-                : summarizeDiagnostics(summary.filePath, policyKept, summary.hasFinalSnapshot);
-        }
-        // #690/#3088: inline `pi-lens-ignore` → the same false-positive/
-        // suppress/defer disposition filter the per-edit dispatch path applies
-        // (dispatcher.ts) → the project's `.pi-lens.json` rule policy. mode=full
-        // merges in diagnostics from a fresh LSP sweep/project scan that never
-        // went through the dispatch path, so without this a disposed finding
-        // reappears here. #3088 folded the three calls onto the shared
-        // `applyFindingPolicy` seam, which the `source=lsp` probe lane now calls
-        // too — one stack, one order, for every model-facing surface.
-        const { kept: policyKept } = applyFindingPolicy(summary.diagnostics, {
-            cwd,
-            filePath: summary.filePath,
-            content,
-            policyMap,
-        });
-        // Tag `flagged` diagnostics for the render loop (formatAllMode). Content
-        // is already in hand here (unlike mode=all/delta's cache-only path), so
-        // this is the one place the tag can be computed without adding I/O to
-        // the "instant" modes.
-        for (const d of policyKept) {
-            // flagged is weak-anchored (module doc, diagnostic-dispositions.ts) so
-            // the tag survives incidental edits to the flagged line itself.
-            const { weak } = anchorsForDiagnostic(cwd, summary.filePath, d, content);
-            if (getDisposition(cwd, weak)?.disposition === "flagged") {
-                d.flagged = true;
-            }
-        }
-        if (policyKept.length === summary.diagnostics.length)
-            return summary;
-        return summarizeDiagnostics(summary.filePath, policyKept, summary.hasFinalSnapshot);
-    }));
-}
-function shouldUseCachedProjectDiagnostics(value) {
-    return value === "cached";
-}
-function shouldRefreshProjectDiagnostics(value) {
-    return value === "cheap" || value === "all";
-}
-/** True when full mode should include project-runner state at all (any non-none refreshRunners). */
-function shouldIncludeProjectRunners(value) {
-    return shouldRefreshProjectDiagnostics(value) || value === "cached";
-}
-/**
- * Merge cache-derived diagnostics from the analyzer extractors (jscpd, madge,
- * gitleaks, knip …) into the scanned project snapshot: append to the existing
- * one (recording the runners), or synthesize a minimal snapshot when there was
- * no in-process scan. Returns the snapshot unchanged when there is nothing extra.
- */
-function foldExtraDiagnosticsIntoSnapshot(snapshot, extra, runners, cwd) {
-    if (extra.length === 0)
-        return snapshot;
-    if (snapshot) {
-        const merged = new Set([...snapshot.runners, ...runners]);
-        return {
-            ...snapshot,
-            diagnostics: [...snapshot.diagnostics, ...extra],
-            runners: [...merged],
-        };
-    }
-    return {
-        version: PROJECT_DIAGNOSTICS_CACHE_VERSION,
-        cwd,
-        tier: "all",
-        scannedAt: new Date().toISOString(),
-        diagnostics: extra,
-        filesScanned: 0,
-        runners,
-    };
-}
-async function getProjectDiagnosticsSnapshotForFullMode(cwd, options) {
-    if (shouldRefreshProjectDiagnostics(options.refreshRunners)) {
-        return scanProjectDiagnostics({
-            cwd,
-            tier: "cheap",
-            maxFiles: options.maxProjectFiles,
-            signal: options.signal,
-            files: options.files,
-            includeGenerated: options.includeGenerated,
-        });
-    }
-    if (shouldUseCachedProjectDiagnostics(options.refreshRunners)) {
-        // The cached snapshot is a cross-session cache; drop diagnostics for files
-        // edited/deleted since the scan so a stale entry isn't replayed (#298). A
-        // fresh scan (above) is current by construction and needs no reconcile.
-        const cached = loadProjectDiagnosticsSnapshot(cwd);
-        if (!cached)
-            return undefined;
-        const reconciled = reconcileProjectDiagnosticsSnapshot(cached);
-        // #2154: what this gate DROPS was invisible — the count was computed and
-        // thrown away, so a session that silently retired another session's rows
-        // (the whole point of the content axis added this round) left no record
-        // of having done so. Bounded by construction: at most one row per
-        // mode=full call, and only when rows were actually retired — the shape
-        // `lsp_authoritative_widget_retire` uses for the sibling arm.
-        if (reconciled.staleDropped > 0) {
-            logLatency({
-                type: "phase",
-                toolName: "lens_diagnostics",
-                filePath: cwd,
-                phase: "project_snapshot_rows_retired",
-                durationMs: 0,
-                metadata: {
-                    files: reconciled.staleDropped,
-                    rows: cached.diagnostics.length - reconciled.snapshot.diagnostics.length,
-                    scannedAt: cached.scannedAt,
-                },
-            });
-        }
-        return reconciled.snapshot;
-    }
-    return undefined;
-}
-// @delivery-surface: lens-diagnostics:mode-full
-async function formatFullMode(cwd, severity, lspService, cacheManager, options = {}) {
-    const runWorkspaceDiagnostics = lspService.runWorkspaceDiagnostics;
-    if (typeof runWorkspaceDiagnostics !== "function") {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: "LSP service does not support project-wide workspace diagnostics.",
-                },
-            ],
-            details: { mode: "full", filesChecked: 0, lspUnavailable: true },
-        };
-    }
-    const { signal, pathsScope, nextWriteIndex } = options;
-    // #2535: advisories name the delivery host's callable tools; pi callers
-    // omit host and keep the pi spelling.
-    const host = options.host ?? "pi";
-    const includeFile = createScopedFileFilter(cwd, pathsScope);
-    // `paths` (#461): route the active scans at exactly the requested files
-    // instead of walking the whole project. Three cases:
-    // - files only → pass them as the explicit list (skips the walk). An EMPTY
-    //   list (every requested file was missing) still passes through — both
-    //   seams treat [] as "scan nothing", where undefined would trigger a full
-    //   project walk that includeFile then filters to nothing (expensive no-op).
-    // - any directory entry → fall back to the walk, narrowed by includeFile.
-    //   Passing only the file entries would silently skip everything under the
-    //   requested directories — an under-scan the caller can't detect.
-    // - no paths → undefined, today's full walk.
-    const explicitFiles = pathsScope && !pathsScope.hasDirectoryEntries
-        ? pathsScope.existingEntries
-        : undefined;
-    // #613: the heavyweight-analyzer fresh-fetch (below) used to be `await`ed
-    // AFTER this Promise.all had already fully resolved — sequentially eating
-    // into the SAME wall-clock ceiling (`FULL_SCAN_WALL_CLOCK_MS`) the LSP sweep
-    // already spent, rather than sharing it concurrently as the old comment here
-    // claimed. On a real project the LSP sweep alone can take 100+s, leaving the
-    // analyzers almost no budget before the shared abort signal fires — killing
-    // ALL of them (even unconditional ones like knip/jscpd/madge) before any
-    // could complete. Building its promise here, alongside the sweep and cheap
-    // scan, makes it genuinely concurrent — all three phases now race the SAME
-    // signal from the same starting point instead of stacking.
-    const projectRunnersRequested = shouldIncludeProjectRunners(options.refreshRunners);
-    const analyzersPromise = projectRunnersRequested
-        ? loadBootstrapClients().then((clients) => fetchFreshProjectDiagnostics(cacheManager, cwd, clients, signal, {
-            runtime: options.runtime,
-            analysisRoot: options.analysisRoot,
-        }))
-        : Promise.resolve({
-            diagnostics: [],
-            runners: [],
-            analyzed: [],
-            authoritativeCoverage: [],
-            // #1623: every heavyweight analyzer is ELIGIBLE for this project but
-            // this call never asked for it (refreshRunners wasn't cheap/all/
-            // cached) — the expensive fetch below deliberately never runs in
-            // that case (see the comment above), but rendering total silence
-            // here reads exactly as "ran clean", the false-empty #1623 exists to
-            // close. `ANALYZER_IDS` (fresh-fetch.ts) is the single source of
-            // truth for which lanes this covers — reuse it rather than
-            // hand-listing ids here.
-            cold: [...ANALYZER_IDS],
-            coldReasons: Object.fromEntries(ANALYZER_IDS.map((id) => [id, notRequestedReason(host)])),
-            failed: [],
-            timings: {},
-        });
-    const [rawLspResults, rawProjectSnapshot, extracted] = await Promise.all([
-        runWorkspaceDiagnostics.call(lspService, cwd, {
-            maxFiles: options.maxLspFiles,
-            signal,
-            onProgress: options.onProgress,
-            onServerReady: options.onServerReady,
-            nextWriteIndex: options.nextWriteIndex,
-            files: explicitFiles,
-        }),
-        getProjectDiagnosticsSnapshotForFullMode(cwd, {
-            ...options,
-            files: explicitFiles,
-        }),
-        analyzersPromise,
-    ]);
-    if (extracted.analysisRootError) {
-        return {
-            content: [{ type: "text", text: extracted.analysisRootError }],
-            isError: true,
-            details: {
-                mode: "full",
-                analysisRootError: extracted.analysisRootError,
-                analysisRootValidation: extracted.analysisRootValidation,
-            },
-        };
-    }
-    const aborted = signal?.aborted ?? false;
-    // #1640: before ANY consumer sees them — the footer reconcile, the widget
-    // merge, the rendered counts — demote TypeScript errors on files tsserver
-    // checked in its INFERRED project. Applied once, here, so a single seam
-    // governs the whole sweep instead of each renderer learning the rule.
-    const lspResults = await demoteInferredProjectSweepResults(rawLspResults.filter((result) => includeFile(result.filePath)), cwd, lspService, 
-    // #1645 review F1: the sweep that produced these results is signal-bounded,
-    // so the probe loop that post-processes them must be too.
-    signal);
-    // A result bound to a different document must not replace the current
-    // widget state, even when it contains real diagnostics. Pull results may carry
-    // a content hash without the push binding verdict, so verify that hash against
-    // disk through the bounded async fallback above; unreadable files remain
-    // unknown and retain the existing fail-open policy.
-    const mismatchedLspResults = await findFullScanBindingMismatches(lspResults);
-    // #630: `timedOut`/`error` means the per-file check never actually
-    // completed or was inconclusive (#570's `touchFile().inconclusive`, or
-    // this sweep's own outer per-file deadline/throw — see
-    // `LSPWorkspaceDiagnosticResult`'s doc comment) — `diagnostics` is a
-    // default-EMPTY placeholder in that case, not a confirmed clean. Partition
-    // once here so BOTH the footer write (below, #571) and the merge into
-    // `summaries` (further down) share the same confirmed/unconfirmed split.
-    // Previously only the footer write excluded these; the merge still fed
-    // the unfiltered `lspResults` in, so a timed-out file's placeholder `[]`
-    // read as "0 diagnostics" — false-clean — in the rendered/`details`
-    // output (#630).
-    const confirmedLspResults = lspResults.filter((result) => !result.timedOut && !result.error && !mismatchedLspResults.has(result));
-    const fullyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) === 0);
-    const partiallyCoveredLspResults = confirmedLspResults.filter((result) => (result.unconfirmedServerIds?.length ?? 0) > 0);
-    const unconfirmedLspResults = lspResults.filter((result) => result.timedOut || result.error || mismatchedLspResults.has(result));
-    const authoritativeLspFiles = new Set();
-    const unreconciledFiles = new Set();
-    // #571: reconcile this scan's fresh, CONFIRMED per-file results into the
-    // footer cache. A footer write is never allowed to fail the tool call, so
-    // any unexpected throw is swallowed.
-    for (const result of fullyCoveredLspResults) {
-        try {
-            // #692: provenance label ONLY — must never affect `rule`/identity (see
-            // `ConvertLspDiagnosticsOptions.scanOrigin`'s doc comment).
-            const diagnostics = convertLspDiagnostics(result.diagnostics, result.filePath, { scanOrigin: "lens_diagnostics_full" });
-            // #692: re-tag aux-sourced findings (ast-grep, opengrep, zizmor, typos)
-            // with their real tool id + semantic policy — the same treatment the
-            // per-edit dispatch runner gives them — so a scan-reconciled entry no
-            // longer keeps tool "lsp". No file content is read here (this loop
-            // only has `result.diagnostics`/`result.filePath` from the sweep, not
-            // the file body) — `detectFileRole` still classifies test files
-            // correctly from the path alone (its content-based checks only refine
-            // generated/stub detection), and native inline-suppression comments
-            // were already applied upstream by `runWorkspaceDiagnostics`
-            // (`applyAuxiliarySuppressions`), so an empty content string here is a
-            // safe no-op re-check rather than a behavior gap.
-            const retagged = retagAuxiliaryDiagnostics(diagnostics, result.diagnostics, "", { cwd, fileRole: detectFileRole(result.filePath) });
-            const retired = reconcileScanDiagnostics(result.filePath, retagged, true, 
-            // The service reserves this token when the file enters the scan. The
-            // fallback preserves compatibility with older test doubles/services.
-            result.writeIndex ?? nextWriteIndex?.(), 
-            // #1093: `observedAt` is set only when this result was served from
-            // the workspace-diagnostics cache (a replay of an older scan) —
-            // stamp `touchedAt` with when it was scanned, not now(), so a
-            // mode=full that only re-serves the cache can't keep a resolved
-            // finding on screen by re-arming the mtime gate. Undefined for
-            // freshly-touched results (observed now).
-            result.observedAt);
-            // A result rejected by the shared ordering guard is not authoritative
-            // for delivery. Otherwise full mode hides the old widget row while
-            // mode=all still serves it, creating a false clean/full disagreement.
-            // Strict `=== true`: `undefined` (a double that predates the boolean
-            // return) takes the unreconciled arm, never the retiring one.
-            if (retired === true) {
-                authoritativeLspFiles.add(path.resolve(result.filePath));
-            }
-            else {
-                unreconciledFiles.add(path.resolve(result.filePath));
-                recordDegradationOnce({
-                    kind: "diagnostic-retained-unreconciled",
-                    subject: `${path.resolve(result.filePath)}:lsp`,
-                    reason: "confirmed diagnostic result could not replace retained widget state",
-                });
-            }
-        }
-        catch {
-            // Never let a footer-reconciliation hiccup fail the scan itself.
-            unreconciledFiles.add(path.resolve(result.filePath));
-            recordDegradationOnce({
-                kind: "diagnostic-retained-unreconciled",
-                subject: `${path.resolve(result.filePath)}:lsp`,
-                reason: "confirmed diagnostic result failed during widget reconciliation",
-            });
-        }
-    }
-    // Project rule policy (`.pi-lens.json` `rules.<id>.disable`/`select`) —
-    // loaded once per mode=full call, BEFORE `projectSnapshot`/`projectDelta`
-    // are built below, so `.diagnostics.length` on both (which feeds
-    // `details.projectDiagnostics`/`details.projectDiagnosticsDelta` as well
-    // as the merge into `summaries`) is the POST-policy count. Threaded into
-    // `applyInlineSuppressionsToSummaries` too (idempotent re-apply there) so
-    // the merged summaries honor the same policy the per-edit dispatch path
-    // applies. A project config read failure is treated as "no policy"
-    // (defensive, matches the `applyInlineSuppressionsToSummaries` read-error
-    // discipline).
-    const policyMap = loadProjectRulePolicyMap(cwd);
-    const scannedSnapshot = filterProjectDiagnosticsSnapshot(rawProjectSnapshot, includeFile);
-    // Heavyweight-analyzer findings (jscpd, madge, gitleaks, knip, govulncheck,
-    // trivy, dead-code) — a FRESH run of each (#585), not a cache-only read:
-    // mode=full is the "authoritative full picture" call, so a session_start-only
-    // snapshot that can be hours stale in a long session is no longer good
-    // enough. Safe to run concurrently with the LSP sweep: every one of these
-    // analyzers has its own in-flight de-dupe guard (KnipClient/JscpdClient/
-    // DeadCodeClient's `inFlight` map, SecurityScanClient.dedupeScan for
-    // gitleaks/govulncheck/trivy — see fresh-fetch.ts's header), so a fresh
-    // fetch here racing a concurrent session_start/turn_end pass over the same
-    // tool JOINS that run instead of double-spawning it. `extracted` was already
-    // computed above, in the SAME `Promise.all` as the LSP sweep (#613) — only
-    // when the caller opted into project-runner state (otherwise it's the
-    // `Promise.resolve({...})` stub from `analyzersPromise` above).
-    // #2154: only ids whose client said it parsed a scan of this root this call
-    // (`FreshProjectDiagnosticsResult.analyzed`). Every exclusion — a skipped
-    // runner, a crash that still reported success, the cache-read test-runner
-    // lane — is decided at the record site in fresh-fetch.ts, not re-derived
-    // here; a second list of "which ids don't count" would be the mirror this
-    // repo's single-source-of-truth rule forbids.
-    const authoritativeRunnerIds = new Set(extracted.analyzed ?? []);
-    const authoritativeRunnerCoverage = extracted.authoritativeCoverage ?? [];
-    const foldedProjectSnapshot = foldExtraDiagnosticsIntoSnapshot(scannedSnapshot, extracted.diagnostics.filter((d) => includeFile(d.filePath)), extracted.runners, cwd);
-    const projectSnapshot = applyProjectRulePolicy(foldedProjectSnapshot, policyMap);
-    const projectDelta = applyProjectRulePolicy(filterProjectDiagnosticsDeltaReport(loadProjectDiagnosticsDeltaReport(cwd), includeFile), policyMap);
-    // #630: only the CONFIRMED LSP results contribute diagnostics to the merge
-    // — an unconfirmed (timed-out/errored) file's placeholder `[]` must not be
-    // read as "0 issues, clean" via its LSP contribution. It can still
-    // legitimately show diagnostics from widgetSummaries/project-runner state
-    // below if those independently have entries for it.
-    // #1993: files with a CONFIRMED, fully-covered LSP result are authoritative
-    // - the fresh sweep replaces their widget-store state instead of merging
-    // additively beside it.
-    // #1993 review: retirement must be observable - if a future regression
-    // makes the set falsely authoritative, findings would vanish silently.
-    const authoritativeRetiredCount = getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath) &&
-        authoritativeLspFiles.has(path.resolve(summary.filePath)) &&
-        (summary.diagnostics?.length ?? 0) > 0).length;
-    if (authoritativeRetiredCount > 0) {
-        logLatency({
-            type: "phase",
-            phase: "lsp_authoritative_widget_retire",
-            filePath: "",
-            durationMs: 0,
-            metadata: { files: authoritativeRetiredCount },
-        });
-    }
-    // #2154 v4 F2: the same rule for the runner arm, in the same shape as its
-    // LSP sibling above — a retirement nobody can see is how a regression
-    // deletes findings silently. Bounded by construction: at most one row per
-    // mode=full call, and only when rows were actually retired.
-    const retiredRunnerCounts = new Map();
-    const runnerRetiredRows = getFileDiagnosticSummaries()
-        .filter((summary) => includeFile(summary.filePath))
-        .reduce((total, summary) => total +
-        (summary.diagnostics ?? []).filter((diagnostic) => {
-            const retired = runnerRetirementDecision(diagnostic, summary.filePath, authoritativeRunnerIds, authoritativeRunnerCoverage) === "retire";
-            if (retired) {
-                const runnerId = runnerIdOf(diagnostic);
-                retiredRunnerCounts.set(runnerId, (retiredRunnerCounts.get(runnerId) ?? 0) + 1);
-            }
-            return retired;
-        }).length, 0);
-    if (runnerRetiredRows > 0) {
-        logLatency({
-            type: "phase",
-            phase: "runner_authoritative_widget_retire",
-            filePath: "",
-            durationMs: 0,
-            metadata: {
-                rows: runnerRetiredRows,
-                runners: [...retiredRunnerCounts.keys()].join(","),
-                coverage: authoritativeRunnerCoverage.map((entry) => ({
-                    runnerId: entry.runnerId,
-                    root: entry.root,
-                    files: entry.files.size,
-                })),
-            },
-        });
-    }
-    for (const entry of authoritativeRunnerCoverage) {
-        // #2962: a zero-file declaration retires nothing, so it must neither
-        // write this row (a `runner_coverage_retired` row with count 0 would
-        // report the opposite of what happened) nor BURN the once-per-session
-        // claim — the session's first real coverage row would then be suppressed
-        // by the call that proved no coverage. Its own observation is the
-        // `runner-coverage-empty` ledger row raised at the fresh-fetch seam.
-        if (entry.files.size === 0)
-            continue;
-        if (!claimPhaseOncePerSession("runner_coverage_retired", entry.runnerId)) {
-            continue;
-        }
-        logLatency({
-            type: "phase",
-            phase: "runner_coverage_retired",
-            filePath: "",
-            durationMs: 0,
-            metadata: {
-                runnerId: entry.runnerId,
-                count: retiredRunnerCounts.get(entry.runnerId) ?? 0,
-            },
-        });
-    }
-    let summaries = await applyInlineSuppressionsToSummaries(mergeDiagnosticsWithWidgetSummaries(getFileDiagnosticSummaries().filter((summary) => includeFile(summary.filePath)), confirmedLspResults, projectSnapshot, projectDelta, authoritativeLspFiles, authoritativeRunnerIds, authoritativeRunnerCoverage), cwd, policyMap);
-    if (unreconciledFiles.size > 0) {
-        summaries = summaries.map((summary) => unreconciledFiles.has(path.resolve(summary.filePath))
-            ? summarizeDiagnostics(summary.filePath, markUnreconciledFindings(summary.diagnostics), summary.hasFinalSnapshot)
-            : summary);
-    }
-    // #1888: the full-mode summary above is the first seam where every
-    // producing lane is correlated. The earlier footer loop intentionally writes
-    // only CONFIRMED LSP results, so an ast-grep backpressure failure left
-    // project-scan (`ast-grep-napi`) findings visible to lens_diagnostics but
-    // absent from the widget. Commit this same post-policy, post-suppression set
-    // to the widget so its human-facing count cannot silently become single-lane.
-    const parsedProjectScanObservedAt = projectSnapshot?.scannedAt
-        ? Date.parse(projectSnapshot.scannedAt)
-        : undefined;
-    const projectScanObservedAt = parsedProjectScanObservedAt !== undefined &&
-        Number.isFinite(parsedProjectScanObservedAt)
-        ? parsedProjectScanObservedAt
-        : undefined;
-    for (const summary of summaries) {
-        reconcileCorrelatedScanDiagnostics(summary.filePath, summary.diagnostics, nextWriteIndex?.(), projectScanObservedAt);
-    }
-    const result = await formatAllMode(cwd, severity, summaries, {
-        mode: "full",
-        lspFilesChecked: rawLspResults.length,
-        partial: aborted,
-        projectDiagnostics: projectSnapshot === undefined
-            ? undefined
-            : {
-                tier: projectSnapshot.tier,
-                filesScanned: projectSnapshot.filesScanned,
-                diagnostics: projectSnapshot.diagnostics.length,
-                runners: projectSnapshot.runners,
-            },
-        projectDiagnosticsDelta: projectDelta === undefined
-            ? undefined
-            : {
-                diagnostics: projectDelta.diagnostics.length,
-                sources: projectDelta.sources,
-                turnIndex: projectDelta.turnIndex,
-            },
-    }, 0, pathsScope);
-    const missingNote = pathsScopeMissingNote(pathsScope);
-    // #630: mirrors `tools/lsp-diagnostics.ts`'s `unconfirmedReasonClause`/
-    // `tallyConfirmation` semantic guarantee (never silently render
-    // unconfirmed as clean), adapted to this tool's own aggregate-summary
-    // shape rather than its per-file result shape. `confirmedLspResults` were
-    // already excluded from the merge above, so an agent reading the summary
-    // alone would otherwise see nothing for these files and could read that
-    // as "0 diagnostics" — say explicitly which files the LSP sweep could not
-    // confirm and why, distinguishing a hard error from a soft timeout the
-    // same way #570 does upstream.
-    const unconfirmedByReason = tallyUnconfirmedReasons(unconfirmedLspResults, mismatchedLspResults);
-    // #646: per-primary-server breakdown of the same confirmed/unconfirmed
-    // tally — lets an agent see AT A GLANCE which server is responsible for
-    // any unconfirmed files (e.g. "marksman: 0/34") instead of having to
-    // cross-reference latency.log by hand. Computed unconditionally so it's
-    // always available in `details` even on an all-confirmed sweep; only
-    // rendered in the text note when more than one server is involved (with
-    // a single server the breakdown is redundant with the totals already
-    // stated).
-    const lspServerBreakdown = tallyLspByPrimaryServer(confirmedLspResults, unconfirmedLspResults);
-    const serverBreakdownClause = lspServerBreakdown.size > 1
-        ? ` — by server: ${formatLspServerBreakdown(lspServerBreakdown)}.`
-        : "";
-    const unconfirmedLspNote = unconfirmedLspResults.length > 0
-        ? `\n\n⚠ LSP sweep: ${confirmedLspResults.length} file(s) confirmed via LSP, ` +
-            `${unconfirmedLspResults.length} unconfirmed (${formatUnconfirmedReasonClause(unconfirmedByReason)})${serverBreakdownClause} — NOT the same as 0 diagnostics for: ${unconfirmedLspResults
-                .slice(0, 20)
-                .map((result) => result.filePath)
-                .join(", ")}${unconfirmedLspResults.length > 20 ? ", …" : ""}. These files' LSP contribution is excluded from this result; re-run mode=full to retry them (they may still show findings above from cached/project-runner state).`
-        : "";
-    // Code-unit comparator (#1883): this list ships as the
-    // `unconfirmedLspServerIds` structured field and as the lane names in the
-    // agent-visible coverage note, so its order must be deterministic across
-    // locales — localeCompare is deliberately avoided.
-    const uncoveredScannerIds = [
-        ...new Set(partiallyCoveredLspResults.flatMap((result) => result.unconfirmedServerIds ?? [])),
-    ].sort((a, b) => Number(a > b) - Number(a < b));
-    const auxiliaryCoverageNote = uncoveredScannerIds.length > 0
-        ? `\n\n⚠ Auxiliary coverage incomplete: ${uncoveredScannerIds.join(", ")} did not answer for ${partiallyCoveredLspResults.length} file(s). Findings from answering servers are included; this is not a clean verdict for the named scanner lane(s).`
-        : "";
-    // #646: primary-vs-auxiliary split of the raw LSP-sweep findings (before
-    // they're merged into the widget-state summaries below), mirroring
-    // `lsp_diagnostics`' "Primary findings"/"Auxiliary findings" separation —
-    // so a page of ast-grep/opengrep/marksman noise never buries whether the
-    // real language server itself found anything in this sweep.
-    const lspPrimaryVsAuxiliary = tallyLspPrimaryVsAuxiliary(confirmedLspResults);
-    logExtension({
-        subsystem: "lsp-diagnostics",
-        message: "lens_diagnostics verdict",
-        metadata: {
-            server: [
-                ...new Set(confirmedLspResults.map((result) => primaryServerId(result.filePath) ?? "unknown")),
-            ].join(","),
-            primary: lspPrimaryVsAuxiliary.primary,
-            auxiliary: lspPrimaryVsAuxiliary.auxiliary,
-            total: lspPrimaryVsAuxiliary.primary + lspPrimaryVsAuxiliary.auxiliary,
-            sources: [
-                ...new Set(confirmedLspResults.flatMap((result) => (result.diagnostics ?? []).map((diagnostic) => diagnostic.source ?? "unknown"))),
-            ].slice(0, 5),
-        },
-    });
-    const lspPrimaryVsAuxiliaryNote = lspPrimaryVsAuxiliary.primary + lspPrimaryVsAuxiliary.auxiliary > 0
-        ? `\n\nLSP sweep findings: ${lspPrimaryVsAuxiliary.primary} primary (language server), ` +
-            `${lspPrimaryVsAuxiliary.auxiliary} auxiliary (ast-grep/opengrep/zizmor/typos/marksman/...).`
-        : "";
-    // #533/#585: a heavyweight analyzer (knip/jscpd/madge/gitleaks/govulncheck/
-    // trivy/dead-code) that contributed nothing this run is either COLD (not
-    // applicable to this project / tool unavailable — see fresh-fetch.ts's
-    // per-analyzer gates) or genuinely clean; `cold` only ever lists the
-    // former. Silently folding "not applicable" into "no issues found" would be
-    // exactly the false-empty #533 is about. Named per #511/#514's
-    // actionable-warning shape: say what's cold and what would warm it, only
-    // when the caller actually asked for runner state (extracted.cold is
-    // always [] otherwise).
-    // #585: an aborted fresh-fetch (Escape / the mode=full wall-clock ceiling)
-    // reports its still-in-flight analyzers separately from a genuine
-    // not-applicable/unavailable skip — "stopped mid-scan, unknown" is a
-    // different, more honest reason than "not applicable to this project", and
-    // conflating them would suggest re-running mode=full is pointless when it
-    // isn't (a re-run may well complete for that analyzer).
-    const abortedIds = new Set(extracted.abortedIds ?? []);
-    const genuinelyColdIds = extracted.cold.filter((id) => !abortedIds.has(id));
-    const partialIds = extracted.partial ?? [];
-    // #747: an unsafe analysis root (cwd at/above $HOME) skips ALL heavyweight
-    // analyzers before anything spawns — rendering that as the per-analyzer
-    // "not applicable / unavailable" list would send the caller chasing seven
-    // wrong reasons. One note with the real one instead.
-    // #1623: prefer the SPECIFIC reason captured at each gate
-    // (`extracted.coldReasons`) over a generic guess — `formatNotRunEntry`
-    // falls back to `warmTriggerFor` only for an id this call's `coldReasons`
-    // doesn't cover (e.g. a caller-supplied `cold` list from an older cache
-    // shape). Single formatter (extractors.ts) so this note's wording can't
-    // drift from any other caller that renders the same `cold` list.
-    // #1623 fix-round F5: the "not requested" (quick-mode) batch shares ONE
-    // reason (`notRequestedReason`) across every id — `formatNotRunEntry`
-    // repeating that same ~130-char sentence per id makes the note nearly
-    // unreadable, and the "not applicable / unavailable this run" header
-    // below is a dishonest label for it: these lanes ARE applicable and
-    // available, this call just never asked for them. Render that batch as
-    // its own compact note — bare ids, the shared reason stated once — and
-    // keep the detailed per-id format for genuinely cold lanes, where each
-    // id's reason really does differ (not a git repo vs binary unavailable
-    // vs retry cooldown, ...).
-    const coldNote = extracted.unsafeRoot
-        ? `\n\nheavyweight analyzers skipped: the analysis root resolves at or above the home directory, so a fresh knip/jscpd/madge/gitleaks/govulncheck/trivy/dead-code scan would walk every unrelated tree under it. Supply a project directory below the home ceiling. Absence of their findings is NOT a clean verdict.`
-        : extracted.analysisRootError
-            ? `\n\nheavyweight analyzers skipped: ${extracted.analysisRootError}. Supply an existing project directory below the home ceiling. Absence of their findings is NOT a clean verdict.`
-            : !projectRunnersRequested && genuinelyColdIds.length > 0
-                ? `\n\nnot run this call (quick mode): ${genuinelyColdIds.join(", ")}. ${notRequestedReason(host)}. Absence of their findings is NOT a clean verdict.`
-                : genuinelyColdIds.length > 0
-                    ? `\n\ncold (not applicable / unavailable this run): ${genuinelyColdIds
-                        .map((id) => formatNotRunEntry(id, extracted.coldReasons))
-                        .join(", ")}. These analyzers have not contributed to this result — absence of their findings is NOT a clean verdict.`
-                    : "";
-    const partialNote = partialIds.length > 0
-        ? `\n\n⚠ partial coverage (findings included): ${partialIds
-            .map((id) => `${id} — ${extracted.partialReasons?.[id] ?? "coverage is incomplete"}`)
-            .join(", ")}. Coverage is incomplete, so absence of findings is NOT a clean verdict.`
-        : "";
-    // #1004: unlike every other analyzer above (knip/jscpd/madge/gitleaks/
-    // govulncheck/opengrep/trivy/dead-code all run a FRESH whole-project scan
-    // per the fresh-fetch.ts header, so "clean" there really does mean "the
-    // whole project was checked this call"), test-runner has no whole-project
-    // run to trigger: its cache only ever reflects the (targeted,
-    // cascade-aware) test file(s) touched by the MOST RECENT edit's turn_end
-    // fire (`runtime-turn.ts`). Folding it into `runners`/`diagnostics` with no
-    // distinguishing note — as opposed to when it's cold, which already gets
-    // `coldNote` above — would let a caller mistake "test-runner ran
-    // project-wide and is clean" for "it only ever saw the 2 files edited an
-    // hour ago", exactly the false-empty/false-confidence #533 this whole
-    // module exists to prevent. Fires whenever test-runner CONTRIBUTED
-    // (`runners`), independent of whether it also has cold/failed entries this
-    // call — a caller needs this caveat on every mode=full response where
-    // test-runner findings are present, not only some.
-    const testRunnerEditScopedNote = extracted.runners.includes("test-runner")
-        ? `\n\ntest-runner coverage is edit-scoped, NOT a full-project run: its findings only reflect the test file(s) touched by the most recent edit's turn_end fire, not a fresh whole-project test suite run (mode=full never re-runs the suite — see fresh-fetch.ts). Absence of test-runner findings elsewhere in the project is NOT a clean verdict, and presence here does not mean "just checked" — it may be from several turns ago.`
-        : "";
-    const failedAnalyzers = extracted.failed ?? [];
-    const failedNote = failedAnalyzers.length > 0
-        ? `\n\nfailed (ran, but no trustworthy result): ${failedAnalyzers
-            .map(({ id, summary }) => `${id} — ${summary}`)
-            .join(", ")}. These analyzers were not cached and will be retried; absence of their findings is NOT a clean verdict.`
-        : "";
-    // #1617: the #1616 suppressed-bucket rule applied to mode=full — a finding
-    // an agent/user marked false-positive/won't-fix now drops out of
-    // `diagnostics` (fresh-fetch.ts's `record()`), but that drop must stay
-    // visible as a count rather than reading as "nothing was wrong here".
-    // Review-round F4 (#1625): per-lane attribution — "gitleaks 2, knip 1" says
-    // WHICH analyzer's marks are doing the suppressing, not just a bare total.
-    // A lane that's 100% suppressed still won't appear in `runners`/`cold` as
-    // distinct from "ran clean" — that gap is #1623's lane-status territory,
-    // not fixed here.
-    const dispositionSuppressedByLaneText = Object.entries(extracted.dispositionSuppressedByLane ?? {})
-        .map(([id, count]) => `${id} ${count}`)
-        .join(", ");
-    const dispositionSuppressedNote = (extracted.dispositionSuppressed ?? 0) > 0
-        ? `\n\nsuppressed by disposition: ${extracted.dispositionSuppressed} finding(s) dropped from this result because they're marked false-positive or won't-fix (${dispositionSuppressedByLaneText}). Not a clean verdict for those locations — they were found, then intentionally hidden.`
-        : "";
-    // #747/#250: the cheap project-diagnostics scan (scanProjectDiagnostics) and
-    // the LSP workspace sweep (collectWorkspaceDiagnosticFiles) both refuse to
-    // WALK from a cwd at/above $HOME — from there, walking would enumerate every
-    // unrelated tree under home. An explicit `paths` file list (explicitFiles)
-    // bypasses both walks, so it is never unsafe. Their empty results in that
-    // case are "walked nothing", not "clean" — say so, matching the fresh-fetch
-    // unsafeRoot note above.
-    const walkUnsafeRoot = explicitFiles === undefined && isAtOrAboveHomeDir(cwd);
-    const walkUnsafeRootNote = walkUnsafeRoot
-        ? `\n\nproject file walk skipped: the working directory resolves at or above the home directory, so the cheap project scan and the LSP workspace sweep would each enumerate every unrelated tree under it. Re-run from inside a project directory. Absence of their findings is NOT a clean verdict.`
-        : "";
-    // #784: the cheap project scan's `scanTruncated` flag (#760) reached this
-    // seam already but nothing rendered it, so a capped scan read as a
-    // complete clean sweep. Say so explicitly, same wording the MCP
-    // `pilens_project_scan` tool uses.
-    const scanTruncatedNoticeText = projectSnapshot
-        ? scanTruncationNotice(projectSnapshot)
-        : undefined;
-    const scanTruncatedNote = scanTruncatedNoticeText
-        ? `\n\n${scanTruncatedNoticeText}`
-        : "";
-    // #1107 phase 2: same "reached the seam, nothing rendered it" gap as #784
-    // above, for the generated-name/dir skip counters.
-    const generatedSkipNoticeText = projectSnapshot
-        ? generatedSkipNotice(projectSnapshot, host)
-        : undefined;
-    const generatedSkipNote = generatedSkipNoticeText
-        ? `\n\n${generatedSkipNoticeText}`
-        : "";
-    // #1623: the cheap in-process project scan (tree-sitter/fact-rules/
-    // ast-grep) is a THIRD lane `coldNote` never covers (it isn't one of
-    // `ANALYZER_IDS` — that list is fetch-fetch.ts's heavyweight analyzers
-    // only). It has three distinct states, all of which must render — the
-    // fix-round F2 finding: with `refreshRunners=cached` and no snapshot ever
-    // written yet, BOTH of the two notes below used to stay empty (one gated
-    // on `scannedAt` being present, the other on the "not requested" branch
-    // this call isn't in), so the original #1623 silence survived in exactly
-    // this mode. `cheapScanScannedAtMs` centralizes the one bit every branch
-    // needs: whether the stored snapshot has a usable timestamp (#1623
-    // fix-round F4 — a corrupt/missing `scannedAt` must not compute a NaN
-    // age, mirroring `./cache.ts`'s `Number.isFinite` guard).
-    const cheapScanScannedAtMs = rawProjectSnapshot?.scannedAt
-        ? Date.parse(rawProjectSnapshot.scannedAt)
-        : undefined;
-    const cheapScanStatusNote = !projectRunnersRequested
-        ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run this call (${notRequestedReason(host)}).`
-        : options.refreshRunners === "cached"
-            ? cheapScanScannedAtMs !== undefined &&
-                Number.isFinite(cheapScanScannedAtMs)
-                ? `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): served from cache, ${formatCacheAgeOld(Date.now() - cheapScanScannedAtMs)} — not re-run this call.`
-                : `\n\ncheap project scan (tree-sitter/fact-rules/ast-grep): not run (no cached scan; refresh with refreshRunners=cheap/all to populate).`
-            : "";
-    const abortedNote = abortedIds.size > 0
-        ? `\n\nstopped mid-scan (still running in the background, not reflected in this result): ${[
-            ...abortedIds,
-        ].join(", ")}. Not a clean verdict for these — re-run mode=full to pick up their result once it's cached.`
-        : "";
-    // #585: mode=full now fetches these analyzers fresh rather than reading a
-    // possibly-stale session_start cache — say so honestly, with per-analyzer
-    // elapsed time, since this can legitimately take a while (trivy's own
-    // ~180s ceiling).
-    // #1623: `extracted.cachedAgeMs` marks ids that are a cache-read BY DESIGN
-    // (today, only test-runner — see fresh-fetch.ts) rather than a fresh
-    // execution this call. Exclude those from "fetched fresh" below — folding
-    // a cache replay into the same list as a genuine run is exactly the
-    // misread the second #1623 dogfood pass reported (a cached result read as
-    // "just ran"). They get their own note with an actual age instead.
-    const cachedAgeMs = extracted.cachedAgeMs ?? {};
-    const timingEntries = Object.entries(extracted.timings ?? {}).filter(([id]) => !(id in cachedAgeMs));
-    const freshNote = timingEntries.length > 0
-        ? `\n\nfetched fresh this call: ${timingEntries
-            .map(([id, ms]) => `${id} (${Math.round(ms)}ms)`)
-            .join(", ")}.`
-        : "";
-    const cachedAgeEntries = Object.entries(cachedAgeMs);
-    const cachedAgeNote = cachedAgeEntries.length > 0
-        ? `\n\nserved from cache this call (not re-run): ${cachedAgeEntries
-            .map(([id, ms]) => `${id} (${formatCacheAgeOld(ms)})`)
-            .join(", ")}.`
-        : "";
-    // coldRunners always lands in details (even when empty) so a caller can
-    // reliably check "were any extractors cold" without a presence check.
-    // analyzerTimingsMs surfaces the #585 fresh-fetch elapsed time per
-    // analyzer that actually ran this call (empty when refreshRunners opted
-    // out of runner state entirely).
-    const resultWithCold = {
-        ...result,
-        details: {
-            ...result.details,
-            coldRunners: extracted.cold,
-            partialRunners: partialIds,
-            // #1623: the specific reason each cold id was skipped (single source
-            // of truth: extractors.ts's `formatNotRunEntry` renders the same map
-            // into the text note above) — lets a caller check WHY without parsing
-            // text.
-            coldReasons: extracted.coldReasons ?? {},
-            failedAnalyzers,
-            analyzerTimingsMs: extracted.timings,
-            dispositionSuppressed: extracted.dispositionSuppressed ?? 0,
-            dispositionSuppressedByLane: extracted.dispositionSuppressedByLane ?? {},
-            // #1623: ms-old each cache-read-by-design lane's data was (today, only
-            // test-runner) — lets a caller distinguish "just ran" from "served
-            // from cache" without parsing the text note.
-            analyzersCachedAgeMs: cachedAgeMs,
-            analyzersAborted: extracted.aborted ?? false,
-            analyzersAbortedIds: extracted.abortedIds ?? [],
-            // #747: true when the fresh fetch refused an at-or-above-$HOME root —
-            // lets a caller distinguish "skipped for safety" from per-analyzer
-            // cold reasons without parsing the text note.
-            // This is the fetch seam's explicit-root policy. The cwd walk below is
-            // intentionally separate: it answers a different root question.
-            analyzersUnsafeRoot: extracted.analysisRootValidation?.state === "unsafe" ||
-                extracted.unsafeRoot === true,
-            analysisRootValidation: extracted.analysisRootValidation,
-            // #747: true when the cwd resolved at/above $HOME so the cheap project
-            // scan and the LSP workspace sweep both refused to walk — lets a caller
-            // distinguish "walked nothing for safety" from a genuinely clean sweep.
-            projectWalkUnsafeRoot: walkUnsafeRoot,
-            // #630: confirmed/unconfirmed LSP-sweep tally, mirroring
-            // `lsp_diagnostics`' confirmation state — lets a caller check "were
-            // any files unconfirmed" without re-deriving it from the text.
-            lspFilesConfirmed: confirmedLspResults.length,
-            lspFilesUnconfirmed: unconfirmedLspResults.length,
-            lspFilesPartiallyCovered: partiallyCoveredLspResults.length,
-            unconfirmedLspServerIds: uncoveredScannerIds,
-            unconfirmedLspFiles: unconfirmedLspResults.map((result) => result.filePath),
-            // #646: per-primary-server breakdown of the same tally, plus the
-            // primary/auxiliary findings split — mirrors `lsp_diagnostics`'
-            // per-server reporting granularity (always present, even when every
-            // server confirmed cleanly, so a caller can check it unconditionally).
-            lspServerBreakdown: Object.fromEntries(lspServerBreakdown),
-            lspPrimaryDiagnosticsCount: lspPrimaryVsAuxiliary.primary,
-            lspAuxiliaryDiagnosticsCount: lspPrimaryVsAuxiliary.auxiliary,
-            // #784: lets a caller check "was the cheap project scan truncated"
-            // without parsing the text note.
-            projectScanTruncated: projectSnapshot?.scanTruncated ?? false,
-            // #1107 phase 2: same machine-readable convention, for the
-            // generated-name/dir skip counters.
-            ...(projectSnapshot?.generatedFileSkips
-                ? { projectGeneratedFileSkips: projectSnapshot.generatedFileSkips }
-                : {}),
-            ...(projectSnapshot?.generatedNameOnlySkips
-                ? {
-                    projectGeneratedNameOnlySkips: projectSnapshot.generatedNameOnlySkips,
-                }
-                : {}),
-            ...(projectSnapshot?.generatedDirSkips
-                ? { projectGeneratedDirSkips: projectSnapshot.generatedDirSkips }
-                : {}),
-        },
-    };
-    // Stopped mid-scan: the results above are whatever completed before the abort.
-    // Tell the agent so it doesn't read a partial sweep as "clean" (#341). The
-    // abort is either a user/turn cancel (Escape) or the wall-clock ceiling firing
-    // (AbortSignal.timeout → TimeoutError), which guarantees the scan can't hang
-    // indefinitely — distinguish them so the agent knows whether to just re-run.
-    if (aborted) {
-        const timedOut = signal
-            ?.reason?.name === "TimeoutError";
-        const note = timedOut
-            ? `\n\n⚠ Scan exceeded its ${Math.round((options.wallClockMs ?? 0) / 1000)}s time budget and was stopped — results are partial. ` +
-                "Narrow it with maxLspFiles, or raise PI_LENS_LENS_DIAGNOSTICS_FULL_TIMEOUT_MS."
-            : "\n\n⚠ Scan cancelled before completion — results are partial. " +
-                "Re-run with a smaller maxLspFiles to finish within budget.";
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: result.content[0].text +
-                        note +
-                        unconfirmedLspNote +
-                        auxiliaryCoverageNote +
-                        lspPrimaryVsAuxiliaryNote +
-                        partialNote +
-                        coldNote +
-                        testRunnerEditScopedNote +
-                        failedNote +
-                        dispositionSuppressedNote +
-                        walkUnsafeRootNote +
-                        scanTruncatedNote +
-                        generatedSkipNote +
-                        abortedNote +
-                        freshNote +
-                        cachedAgeNote +
-                        cheapScanStatusNote +
-                        missingNote,
-                },
-            ],
-            details: { ...resultWithCold.details, timedOut },
-        };
-    }
-    if (missingNote ||
-        coldNote ||
-        partialNote ||
-        testRunnerEditScopedNote ||
-        failedNote ||
-        dispositionSuppressedNote ||
-        walkUnsafeRootNote ||
-        scanTruncatedNote ||
-        generatedSkipNote ||
-        abortedNote ||
-        freshNote ||
-        cachedAgeNote ||
-        cheapScanStatusNote ||
-        unconfirmedLspNote ||
-        auxiliaryCoverageNote ||
-        lspPrimaryVsAuxiliaryNote) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: result.content[0].text +
-                        unconfirmedLspNote +
-                        auxiliaryCoverageNote +
-                        lspPrimaryVsAuxiliaryNote +
-                        partialNote +
-                        coldNote +
-                        testRunnerEditScopedNote +
-                        failedNote +
-                        dispositionSuppressedNote +
-                        walkUnsafeRootNote +
-                        scanTruncatedNote +
-                        generatedSkipNote +
-                        abortedNote +
-                        freshNote +
-                        cachedAgeNote +
-                        cheapScanStatusNote +
-                        missingNote,
-                },
-            ],
-            details: resultWithCold.details,
-        };
-    }
-    return resultWithCold;
-}
-async function projectResolvedCwd(summary, cwd) {
-    // #2777 O1: the whole three-way lookup lives on the LSP seam now. A file
-    // with no primary LSP server is `undefined` here by construction, and
-    // formatAllMode renders that row without a cwd term (N1) — the literal
-    // `cwd=undefined` cannot be produced.
-    const resolvedCwd = await resolveLspCwdForFile(summary.filePath, cwd);
-    return {
-        ...summary,
-        ...(resolvedCwd === undefined ? {} : { resolvedCwd }),
-        diagnostics: summary.diagnostics ?? [],
-    };
-}
-// @delivery-surface: lens-diagnostics:mode-all
-async function formatAllMode(cwd, severity, summaries = getFileDiagnosticSummaries(), detailOverrides = { mode: "all" }, staleDropped = 0, pathsScope, dependencyDemoted = 0) {
-    // #2275 review F2: the widget footer stops DRAWING a dependency-drift
-    // demotion once it hits `DEPENDENCY_DRIFT_MAX_DELIVERIES` unconfirmed
-    // deliveries, but the record stays here (dropping it would make an
-    // unconfirmed LSP error read as clean). Say so, through the same note
-    // channel as the demotion itself, so the agent knows why the footer went
-    // quiet and that a re-run can still confirm the finding.
-    const footerCapped = summaries.reduce((n, s) => n + (s.diagnostics ?? []).filter((d) => d.footerRetired === true).length, 0);
-    // Files changed/deleted since their diagnostics were recorded have already
-    // been dropped by reconcileStaleWidgetFiles; note them so the agent knows
-    // those aren't "clean", just un-rescanned (use mode=full to refresh).
-    const staleNote = (staleDropped > 0
-        ? ` (${staleDropped} changed file${staleDropped === 1 ? "" : "s"} omitted as stale — use mode=full to rescan)`
-        : "") +
-        (dependencyDemoted > 0
-            ? ` (${dependencyDemoted} blocking finding${dependencyDemoted === 1 ? "" : "s"} demoted to [stale] — an imported file changed since; re-run to confirm)`
-            : "") +
-        (footerCapped > 0
-            ? ` (${footerCapped} demoted finding${footerCapped === 1 ? "" : "s"} capped after ${DEPENDENCY_DRIFT_MAX_DELIVERIES} unconfirmed deliveries — no longer shown in the pi-lens footer, still listed here; re-run to confirm)`
-            : "");
-    // mode=full already actively scanned exactly the requested paths, so a zero
-    // result there IS a legitimate clean read — the cache-only note only applies
-    // to delta/all, which is why this is gated on detailOverrides.mode !== "full".
-    const isFullMode = detailOverrides.mode === "full";
-    const includeFile = createScopedFileFilter(cwd, pathsScope);
-    // Cached summaries predate marks. Every cache-only surface re-applies
-    // dispositions through the shared applyCachedDispositions seam — strict
-    // false-positive anchors against current content when the file is
-    // unchanged since observation, weak-only fallback otherwise.
-    const policyMap = loadProjectRulePolicyMap(cwd);
-    const dispositioned = isFullMode
-        ? summaries
-        : summaries.map((s) => {
-            const diagnostics = s.diagnostics ?? [];
-            const kept = applyCachedDispositions(diagnostics, cwd, s.filePath);
-            const policyKept = applyRulePolicy(kept, policyMap);
-            if (policyKept.length === kept.length &&
-                kept.length === diagnostics.length)
-                return s;
-            return summarizeDiagnostics(s.filePath, policyKept, s.hasFinalSnapshot);
-        });
-    // #1641: the single chokepoint both mode=all (cache-only `summaries`) and
-    // mode=full (widget cache merged with a FRESH LSP sweep, above) converge
-    // through — a fresh sweep's server can still be citing its own stale
-    // in-memory document, so gating only the cached half would miss exactly
-    // the live incident this issue reports. Runs AFTER dispositions/rule
-    // policy (not before): a finding a mark or a `.pi-lens.json` rule policy
-    // already dropped is not being served, so it must never trigger a resync
-    // or a `diagnostic_past_eof` telemetry record on this call.
-    const eofGated = dispositioned.map((s) => {
-        const { diagnostics, demotedCount } = demotePastEofDiagnostics({
-            store: "lens_diagnostics",
-            cwd,
-            filePath: s.filePath,
-            diagnostics: s.diagnostics ?? [],
-            resync: resyncDocumentOnPastEof,
-        });
-        if (demotedCount === 0)
-            return s;
-        return summarizeDiagnostics(s.filePath, diagnostics, s.hasFinalSnapshot);
-    });
-    const visibleSummaries = eofGated.filter((s) => includeFile(s.filePath));
-    // Filter to files with actual issues. A file whose only findings were
-    // demoted by the #1641 past-EOF gate has blocking/errors/warnings at 0 —
-    // counting it as "issue-free" would tell the agent the file is CLEAN when
-    // it actually has an unconfirmed finding waiting on a rescan. Surface it
-    // under `severity: "all"` (the gate's own advisory tier) so it stays
-    // visible; a narrower `error`/`warning` filter still excludes it, matching
-    // how those filters already treat any other non-matching severity.
-    const withIssues = visibleSummaries.filter((s) => {
-        if (severity === "error")
-            return s.blocking > 0 || s.errors > 0;
-        // #2414: a "warning" filter must not admit hint/info — that is exactly
-        // the "present hints as warnings" defect this issue exists to close.
-        if (severity === "warning")
-            return s.blocking > 0 || s.errors > 0 || s.warnings > 0;
-        // severity: "all" — a hint/info-only file (`advisories > 0`,
-        // warnings === 0) must still surface here, or the #2414 fix that stops
-        // hints inflating `warnings` would silently drop that file from the
-        // detailed listing instead of just from the compact warning tally.
-        return (s.blocking > 0 ||
-            s.errors > 0 ||
-            s.warnings > 0 ||
-            s.advisories > 0 ||
-            (s.diagnostics ?? []).some((d) => d.stale));
-    });
-    const pathsNote = isFullMode ? "" : pathsScopeCacheOnlyNote(pathsScope);
-    if (withIssues.length === 0) {
-        const text = (visibleSummaries.length === 0
-            ? "No files diagnosed yet this session."
-            : `No ${severity === "all" ? "" : severity + " "}issues across ${visibleSummaries.length} file${visibleSummaries.length === 1 ? "" : "s"} diagnosed this session. ✓`) +
-            staleNote +
-            pathsNote;
-        return {
-            content: [{ type: "text", text }],
-            details: {
-                ...detailOverrides,
-                filesChecked: visibleSummaries.length,
-                staleDropped,
-            },
-        };
-    }
-    // Sort: blocking first, then errors, then warnings
-    const sorted = withIssues.sort((a, b) => b.blocking - a.blocking || b.errors - a.errors || b.warnings - a.warnings);
-    // #2777 O2: only rendered rows resolve their root. The projection sits
-    // below the withIssues filter, so a 500-file session pays the cwd
-    // resolution for the handful of rows listed here, not for every summary
-    // the cache holds.
-    const rendered = await Promise.all(sorted.map((summary) => projectResolvedCwd(summary, cwd)));
-    const lines = [];
-    let totalBlocking = 0;
-    let totalErrors = 0;
-    let totalWarnings = 0;
-    let totalAdvisories = 0;
-    for (const s of rendered) {
-        const rel = path.relative(cwd, s.filePath);
-        const parts = [];
-        if (s.blocking > 0)
-            parts.push(`🔴 ${s.blocking} blocking`);
-        if (s.errors > 0 && s.blocking === 0)
-            parts.push(`${s.errors}E`);
-        if (s.warnings > 0)
-            parts.push(`${s.warnings}W`);
-        // #2414: hint/info never inflate `warnings`, but a hint-only row still
-        // needs a reason to be listed — otherwise it shows a bare filename with
-        // no count at all.
-        if (s.advisories > 0)
-            parts.push(`${s.advisories} hint${s.advisories === 1 ? "" : "s"}`);
-        if (!s.hasFinalSnapshot)
-            parts.push(`(pending)`);
-        const staleCount = (s.diagnostics ?? []).filter((d) => d.stale).length;
-        if (staleCount > 0) {
-            parts.push(`${staleCount} stale — re-run to confirm`);
-        }
-        // #2777 N1: files with no primary LSP server have no resolvedCwd —
-        // omit the term rather than rendering the literal `cwd=undefined`.
-        if (s.resolvedCwd !== undefined)
-            parts.push(`cwd=${s.resolvedCwd}`);
-        lines.push(`${rel}  ${parts.join("  ")}`);
-        // List the actual diagnostics (not just counts) so the agent can act on
-        // them without re-running anything — same "L<line>: <message>" shape as the
-        // inline blocker output. The widget state now exposes the FULL set (not the
-        // TUI's 12-cap); the tool applies its own generous per-file budget purely to
-        // avoid flooding context on a pathologically broken file.
-        const matching = (s.diagnostics ?? [])
-            .filter((d) => matchesSeverity(d, severity))
-            .sort(bySeverityThenLine);
-        const shown = matching.slice(0, MAX_DIAGNOSTICS_PER_FILE);
-        for (const d of shown) {
-            const marker = d.stale
-                ? ""
-                : isErrorLike(d)
-                    ? d.semantic === "blocking"
-                        ? "🔴 "
-                        : ""
-                    : "";
-            const label = d.rule ?? d.tool;
-            const tag = label ? ` [${label}]` : "";
-            const flaggedTag = d.flagged ? " 📌 flagged-to-fix" : "";
-            const msg = d.message.replace(/\s+/g, " ").trim();
-            // #1641: a demoted past-EOF entry no longer has a trustworthy line —
-            // show the marker instead of a coordinate that doesn't exist in the
-            // current file, matching the #1622/#1627 stale-line render convention.
-            // Past-EOF demotions replace the untrustworthy coordinate; other
-            // demotions (#1631 drift) keep their in-bounds line and append the
-            // shared stale marker instead.
-            const pastEof = d.stale && (d.staleReason ?? "past-eof") === "past-eof";
-            const loc = pastEof ? PAST_EOF_STALE_MARKER : `L${d.line ?? "?"}`;
-            const staleTag = d.stale && !pastEof ? ` ${STALE_LINE_MARKER}` : "";
-            lines.push(`  ${marker}${loc}: ${msg}${tag}${flaggedTag}${staleTag}`);
-        }
-        if (matching.length > shown.length) {
-            lines.push(`  … ${matching.length - shown.length} more in this file (showing ${shown.length} of ${matching.length})`);
-        }
-        totalBlocking += s.blocking;
-        totalErrors += s.errors;
-        totalWarnings += s.warnings;
-        totalAdvisories += s.advisories;
-    }
-    // #1799: `totalBlocking` and `totalErrors` count the same findings UNLESS a
-    // dependency-drift demotion (#1631) has revoked blocking authority from an
-    // error while leaving it in the error tally (widget-state.ts `isBlocking`
-    // vs `countDiagnostics`) — that's a real, live disagreement between the two
-    // totals, not double-counting. So `errors` renders only when
-    // `blocking === 0`, same guard as the per-file row above: it shows the
-    // drift-demoted findings the blocking line can't, without ever printing the
-    // same findings twice under two labels when blocking > 0.
-    const summary = [
-        `\nSummary (${visibleSummaries.length} files diagnosed this session):`,
-        totalBlocking > 0
-            ? `  🔴 ${totalBlocking} blocking error${totalBlocking === 1 ? "" : "s"}`
-            : null,
-        totalBlocking === 0 && totalErrors > 0
-            ? `  ${totalErrors} error${totalErrors === 1 ? "" : "s"}`
-            : null,
-        totalWarnings > 0
-            ? `  ${totalWarnings} warning${totalWarnings === 1 ? "" : "s"}`
-            : null,
-        // #2414: reported separately from `warnings` — hint/info are style
-        // opinions, not defects, and must not read as unresolved code issues.
-        totalAdvisories > 0
-            ? `  ${totalAdvisories} hint/info (style — not counted as warnings)`
-            : null,
-    ]
-        .filter(Boolean)
-        .join("\n");
-    return {
-        content: [
-            { type: "text", text: lines.join("\n") + summary + staleNote },
-        ],
-        details: {
-            ...detailOverrides,
-            filesWithIssues: withIssues.length,
-            totalBlocking,
-            totalErrors,
-            totalWarnings,
-            totalAdvisories,
-            staleDropped,
-        },
-    };
-}