@herbertgao/pi-extensions 2026.10.2 → 2026.10.4

package/node_modules/pi-lens/dist/mcp/worker.js

@@ -2,74 +2,74 @@
 import { createRequire as __pilensCreateRequire } from "node:module"; const require = __pilensCreateRequire(import.meta.url);
 import {
   analyzeFile
-} from "../chunk-TLGFBM3F.js";
-import "../chunk-C2AUYXQH.js";
-import "../chunk-I3R7GKDR.js";
+} from "../chunk-ZZUFZUQZ.js";
+import "../chunk-ZOEYVXSV.js";
+import "../chunk-KJN4IOEJ.js";
 import "../chunk-FC4RP4I2.js";
-import "../chunk-DFVMIKMQ.js";
-import "../chunk-TO6WL3GM.js";
-import "../chunk-7F72PXY2.js";
-import "../chunk-RPD5K5NC.js";
-import "../chunk-ZMOL6RQC.js";
-import "../chunk-I7SPGOWI.js";
-import "../chunk-AS44CFQ4.js";
-import "../chunk-7FBF7NPR.js";
-import "../chunk-HHYAELLJ.js";
-import "../chunk-V5PXFSZK.js";
-import "../chunk-YLF3PPT5.js";
-import "../chunk-JOLITGCC.js";
-import "../chunk-E2WFBRHM.js";
-import "../chunk-6VCD4VKZ.js";
-import "../chunk-F3P7VQ7H.js";
-import "../chunk-LSMJ6KBE.js";
+import "../chunk-YLN4K6WD.js";
+import "../chunk-J3FZR3YY.js";
+import "../chunk-5JHXUETW.js";
+import "../chunk-3MRXIJ6I.js";
+import "../chunk-TA5L5KWQ.js";
+import "../chunk-FGALODG3.js";
+import "../chunk-OC7LYAU5.js";
+import "../chunk-NFXP47RV.js";
+import "../chunk-MGIWSROG.js";
+import "../chunk-WSEWKCXU.js";
+import "../chunk-MQA2YBAH.js";
+import "../chunk-TQFBZVCG.js";
+import "../chunk-WATC3IQR.js";
+import "../chunk-OYOB3ZFG.js";
+import "../chunk-XHSCVSOL.js";
+import "../chunk-V5MEBST3.js";
 import "../chunk-3MED75HT.js";
-import "../chunk-3I5QFT3N.js";
-import "../chunk-TVN5N6GY.js";
-import "../chunk-ARFCXG7S.js";
-import "../chunk-OAXNDZJ7.js";
+import "../chunk-IMSQR4WO.js";
+import "../chunk-MTDRLSI7.js";
+import "../chunk-OZJINN4O.js";
+import "../chunk-3JSEWUWI.js";
 import "../chunk-XIMYZ3JA.js";
-import "../chunk-B3I2UUT4.js";
-import "../chunk-DIULIWKU.js";
-import "../chunk-VDBPVIKD.js";
+import "../chunk-IQZXOZ7S.js";
+import "../chunk-LNOMA3MP.js";
+import "../chunk-U52SAGRM.js";
 import "../chunk-5W3R6LFT.js";
-import "../chunk-LW6XKDZQ.js";
+import "../chunk-UEAHAMEI.js";
 import "../chunk-Z54ZSOBZ.js";
-import "../chunk-TGPXLY2J.js";
+import "../chunk-KJCWXUUS.js";
 import "../chunk-QOZXJ4NA.js";
-import "../chunk-V7R425XG.js";
-import "../chunk-PAK6IDME.js";
-import "../chunk-GUOGVTCQ.js";
-import "../chunk-AJVLWNFN.js";
-import "../chunk-YGVYKNSN.js";
-import "../chunk-LNAKEO63.js";
+import "../chunk-6XX5HCLK.js";
+import "../chunk-S6AMWKPC.js";
+import "../chunk-F5VLZHUW.js";
+import "../chunk-AXKPQ6ZI.js";
+import "../chunk-7BX5DWSA.js";
+import "../chunk-IUKPRZER.js";
 import "../chunk-Z3CCVDUB.js";
-import "../chunk-PWFHBTSF.js";
+import "../chunk-XGUL4SLQ.js";
 import "../chunk-2BEMIWEW.js";
-import "../chunk-OQGFCZJ4.js";
-import "../chunk-RUOG5D2C.js";
-import "../chunk-U3VGR4VU.js";
-import "../chunk-NTUJEGDZ.js";
-import "../chunk-EOKRQ3SA.js";
-import "../chunk-WONERJTP.js";
-import "../chunk-22AVIGXS.js";
-import "../chunk-GVXA6CCE.js";
-import "../chunk-6QIUX4EP.js";
-import "../chunk-VHQLPIRJ.js";
-import "../chunk-VN2AXLEX.js";
+import "../chunk-LD7WFTRX.js";
+import "../chunk-IUR76K6A.js";
+import "../chunk-T4QZ6FEH.js";
+import "../chunk-D6YF5HKX.js";
+import "../chunk-CMU4RMJB.js";
+import "../chunk-O7HZX7CA.js";
+import "../chunk-VYKKMYVT.js";
+import "../chunk-BNKLYOOO.js";
+import "../chunk-USHG4DLH.js";
+import "../chunk-H5EV3VMF.js";
+import "../chunk-T54VJRAD.js";
 import "../chunk-BW5KFIQC.js";
 import "../chunk-QYF5S6P6.js";
-import "../chunk-5ZEJHV35.js";
-import "../chunk-DQ2NZ7C4.js";
-import "../chunk-VNMT7C64.js";
+import "../chunk-64LU2OVH.js";
+import "../chunk-N2IRDBZI.js";
+import "../chunk-Z6BB4JLQ.js";
 import "../chunk-2EECBNC5.js";
-import "../chunk-N3YQJI6O.js";
-import "../chunk-O6TQT6RI.js";
-import "../chunk-5THXD6X5.js";
-import "../chunk-UK3CMEAL.js";
+import "../chunk-7ELY2CSM.js";
+import "../chunk-34OCDWOS.js";
+import "../chunk-3PNFWVHT.js";
+import "../chunk-VSMJK3ZJ.js";
 import "../chunk-LJDODBBZ.js";
-import "../chunk-NMABWBZN.js";
+import "../chunk-UGSMCQ4D.js";
 import "../chunk-ABBOA7UD.js";
-import "../chunk-Q5U6FMDI.js";
+import "../chunk-G3RLJYA2.js";
 import "../chunk-NXL4FFQQ.js";
 
 // dist/mcp/worker.js

package/node_modules/pi-lens/dist/probes/installer.js

@@ -53,30 +53,30 @@ import {
   verifyNpmPackageEntry,
   verifyToolBinary,
   wasLastResolveTransient
-} from "../chunk-OQGFCZJ4.js";
-import "../chunk-RUOG5D2C.js";
-import "../chunk-U3VGR4VU.js";
-import "../chunk-NTUJEGDZ.js";
-import "../chunk-EOKRQ3SA.js";
-import "../chunk-WONERJTP.js";
-import "../chunk-22AVIGXS.js";
-import "../chunk-GVXA6CCE.js";
-import "../chunk-6QIUX4EP.js";
-import "../chunk-VHQLPIRJ.js";
-import "../chunk-VN2AXLEX.js";
+} from "../chunk-LD7WFTRX.js";
+import "../chunk-IUR76K6A.js";
+import "../chunk-T4QZ6FEH.js";
+import "../chunk-D6YF5HKX.js";
+import "../chunk-CMU4RMJB.js";
+import "../chunk-O7HZX7CA.js";
+import "../chunk-VYKKMYVT.js";
+import "../chunk-BNKLYOOO.js";
+import "../chunk-USHG4DLH.js";
+import "../chunk-H5EV3VMF.js";
+import "../chunk-T54VJRAD.js";
 import "../chunk-BW5KFIQC.js";
 import "../chunk-QYF5S6P6.js";
-import "../chunk-5ZEJHV35.js";
-import "../chunk-DQ2NZ7C4.js";
-import "../chunk-VNMT7C64.js";
+import "../chunk-64LU2OVH.js";
+import "../chunk-N2IRDBZI.js";
+import "../chunk-Z6BB4JLQ.js";
 import "../chunk-2EECBNC5.js";
-import "../chunk-N3YQJI6O.js";
-import "../chunk-O6TQT6RI.js";
-import "../chunk-5THXD6X5.js";
-import "../chunk-UK3CMEAL.js";
+import "../chunk-7ELY2CSM.js";
+import "../chunk-34OCDWOS.js";
+import "../chunk-3PNFWVHT.js";
+import "../chunk-VSMJK3ZJ.js";
 import "../chunk-LJDODBBZ.js";
 import "../chunk-ABBOA7UD.js";
-import "../chunk-Q5U6FMDI.js";
+import "../chunk-G3RLJYA2.js";
 import "../chunk-NXL4FFQQ.js";
 export {
   GITHUB_TOOLS,

package/node_modules/pi-lens/docs/ast-grep_rules_catalog.md

@@ -231,7 +231,7 @@ See [`docs/custom-rules.md`](custom-rules.md) to add your own. Rule sources: `ru
 | `prefer-structured-clone-js` | warning | no | pi-lens | Use structuredClone() instead of JSON.parse(JSON.stringify()) for deep cloning |
 | `strict-equality-js` | warning | yes | pi-lens | Use === instead of == |
 | `strict-inequality-js` | warning | yes | pi-lens | Use !== instead of != |
-| `throw-new-error-js` | error | no | pi-lens | Use new Error() not Error() — explicit construction is clearer |
+| `throw-new-error-js` | warning | no | pi-lens | Use new Error() not Error() — explicit construction is clearer |
 | `unchecked-throwing-call-js` | error | no | pi-lens | $CALL without try/catch — throws on invalid input |
 | `weak-rsa-key-js` | error | no | pi-lens | Weak RSA key size — use at least 2048 bits |
 
@@ -547,7 +547,7 @@ See [`docs/custom-rules.md`](custom-rules.md) to add your own. Rule sources: `ru
 | `strict-equality` | warning | yes | pi-lens | Use === instead of == |
 | `strict-inequality` | warning | yes | pi-lens | Use !== instead of != |
 | `switch-without-default` | warning | no | pi-lens | switch has no default clause — values matching no case are silently ignored; add a default (even one that throws) |
-| `throw-new-error` | error | no | pi-lens | Use new Error() not Error() — explicit construction is clearer |
+| `throw-new-error` | warning | no | pi-lens | Use new Error() not Error() — explicit construction is clearer |
 | `ts-array-concat-spread` | warning | no | pi-lens | arr.concat([...items]) - use arr.push(...items) or [...arr, ...items] |
 | `ts-array-every-some` | warning | no | pi-lens | arr.map(x => x.prop).every(Boolean) - use arr.every(x => !!x.prop) |
 | `ts-boolean-return-if-else` | warning | no | pi-lens | if/else returning true/false - simplify to return the condition directly |

package/node_modules/pi-lens/docs/configuration.md

@@ -10,6 +10,14 @@ There are **two** pi-lens config files:
 Both files have the same shape, with one exception noted below the example:
 everything LSP-related lives under an `lsp` namespace inside them.
 
+The editor-facing JSON Schema is published at
+[`docs/schema/pi-lens-config-v1.json`](schema/pi-lens-config-v1.json). LSP
+server entries also accept canonical argv arrays, optional `name` (defaulting
+to the map id), `enabled`, `role` (`language` or `auxiliary`), `args`, and
+`rootMarkers`. These new fields are experimental; reserved role, root-policy,
+and timing semantics are inert until their planned catalog slices land, so this
+schema slice does not change server launch behavior.
+
 ```jsonc
 {
   "$schema": "https://raw.githubusercontent.com/apmantza/pi-lens/master/docs/schema/pi-lens-config-v1.json",
@@ -23,8 +31,7 @@ everything LSP-related lives under an `lsp` namespace inside them.
       "my-server": {
         "name": "My Custom LSP",
         "extensions": [".myext"],
-        "command": "my-lsp-server",
-        "args": ["--stdio"],
+        "command": ["my-lsp-server", "--stdio"],
         "covers": ["shellcheck"]
       }
     },

package/node_modules/pi-lens/docs/custom-rules.md

@@ -1,6 +1,6 @@
 # Custom Rules
 
-pi-lens picks up project-local rules automatically alongside its built-ins.
+pi-lens picks up project-local and user-level rules automatically alongside its built-ins.
 Drop YAML files in the right directory and they are active on the next file dispatch — no config required.
 
 > For the full list of bundled rules per language, see the generated catalogs:
@@ -20,7 +20,30 @@ your-project/
         my-rule.yml        ← ast-grep rule, overrides built-in with same id
 ```
 
-Project ast-grep rules are fingerprinted by relative path and contents, so in-place edits, renames, additions, and removals take effect within one tool call even when mtimes are preserved. Tree-sitter rules retain their directory-mtime cache.
+Both rule families are fingerprinted by relative path and contents, so in-place edits, renames, additions, and removals are picked up without a restart, even when mtimes are preserved.
+
+### When an edit takes effect
+
+A per-file dispatch reads the rule corpus fresh every time: its cache key is a
+content fingerprint of every rule file the language's rule set is built from,
+so an edit, addition, or removal is live on the next dispatched file.
+
+Whole-project surfaces — a project scan and a structural search — reuse a
+corpus fingerprint computed once per turn, so a rule edit lands on the next
+turn, or immediately if any file is dispatched in between (a dispatch
+republishes the fresh fingerprint for the rest of that turn). This is what
+keeps a warm scan at the cost of a string comparison instead of re-reading
+every rule file on every call.
+
+### User-level rules
+
+Rules shared across projects live under the relocatable machine-data directory:
+`<PI_LENS_HOME>/rules/` (or the platform default pi-lens directory when
+`PI_LENS_HOME` is unset). Use the same `tree-sitter-queries/` and
+`ast-grep-rules/` layout shown above. Precedence is project > user > bundled;
+when rule IDs collide, the higher tier wins and the lower definition is
+shadowed from execution. User rules are part of the same fingerprints as
+project rules, so they follow the same timing above.
 
 ---
 

package/node_modules/pi-lens/docs/environment-variables.md

@@ -104,12 +104,14 @@ without changing the steady-state behaviour of an interactive session.
 
 ### `PI_LENS_STARTUP_SCAN_VERDICT_TTL_MS`
 
-How long (ms) a persisted `too-many-source-files` startup-scan verdict is
-trusted before the source-file count is re-walked (default 24h). The verdict
-is cached in the project snapshot so repeated `pi -p` runs in a very large
-repo skip the counting walk entirely; a repo that shrinks below the threshold
-recovers when the TTL expires. Other verdicts use content-based freshness and
-ignore this setting.
+How long (ms) a persisted size-skip startup-scan verdict (`too-many-source-files`
+or `too-many-entries`) is trusted before the project is re-walked (default
+24h). The verdict is cached in the project snapshot so repeated `pi -p` runs in
+a very large repo skip the counting walk entirely; a repo that shrinks below
+the threshold recovers when the TTL expires. The verdict also records the
+bounds that produced it (`maxProjectFiles`, `PI_LENS_STARTUP_SCAN_MAX_ENTRIES`),
+so raising either one invalidates it at once and the next session re-walks.
+Other verdicts use content-based freshness and ignore this setting.
 
 ## Scale and limits
 
@@ -144,6 +146,24 @@ Minimum wall-clock budget (ms) for every dispatch runner; the effective timeout
 is `max(runner budget, floor)`. **Default:** `0` (no floor). Also settable via
 the `dispatch.runnerTimeoutFloorMs` config key, which wins when both are set.
 
+### `PI_LENS_WORD_INDEX_MEMO_BACKSTOP_MS`
+
+Backstop (ms) for the word index's serialized memo, which is also its
+incremental-serialize cache: it is kept while a run edits (so each per-edit
+persist stays O(dirty tokens)) and released once per run at `agent_settled`.
+The backstop releases it when no persist has refreshed it for this long, for a
+host that never emits `agent_settled` and for a stalled run. It is re-armed by
+every serialize and never keeps the process alive. **Default:** `600000` (10
+minutes). `0`, a negative or a non-numeric value means the default (a backstop
+that fired at once would switch the memo off), and a value above `2147483647`
+(about 24.8 days, Node's largest timer delay) is clamped to it. The default is
+deliberately conservative: the maintainer's
+`latency.log` held only two intra-run gaps between `project_snapshot_persist`
+records (5.8 s), too few to derive a percentile. A release leaves one
+`word_index_memo_released` row in `latency.log` (`trigger`: `settle`,
+`post_settle_persist` or `backstop`). Releasing costs the next persist a full
+re-serialize.
+
 ## Install control
 
 ### `PI_LENS_DISABLE_LSP_INSTALL`
@@ -268,6 +288,14 @@ nightly measurement behind each declaration, is in
 When unset or invalid, `PI_LENS_TS_IDLE_EVICT_MS` (below) is read.
 **Default:** 20 minutes (`1200000`).
 
+### `PI_LENS_EPHEMERAL_LSP_IDLE_EVICT_MS`
+
+Idle window (ms) for language-service clients whose workspace is inside a
+temporary or ephemeral Git checkout. This overrides the shared window above
+for those roots; when unset or invalid, the default is 60 seconds (`60000`).
+The nightly idle-eviction measurement temporarily sets this variable alongside
+`PI_LENS_LSP_IDLE_EVICT_MS` so both root policies are measured.
+
 ### `PI_LENS_TS_IDLE_EVICT_MS`
 
 The original, TypeScript-named spelling of the same window, retained for

package/node_modules/pi-lens/docs/features.md

@@ -183,7 +183,7 @@ pi-lens MCP server expose the same shape to Claude Code / any MCP client.
 
 At `turn_end`, pi-lens writes `<project-data-dir>/cache/actionable-warnings.json` summarizing fixable warnings introduced by the current turn. This powers the optional conservative autofix at `agent_end`.
 
-`<project-data-dir>` is whatever `getProjectDataDir(cwd)` resolves to: `<project>/.pi-lens` only when that legacy directory already exists, otherwise `~/.pi-lens/projects/<project-slug>` (or a `PILENS_DATA_DIR` location). The turn-end advisory points at `lens_diagnostics mode=delta` first and names the resolved file second, so you never have to work the layout out by hand (#2521).
+`<project-data-dir>` is whatever `getProjectDataDir(cwd)` resolves to: `<project>/.pi-lens` only when that legacy directory already exists when the process first resolves the root (a `.pi-lens` created mid-process takes effect at the next process start), otherwise `~/.pi-lens/projects/<project-slug>` (or a `PILENS_DATA_DIR` location). The turn-end advisory points at `lens_diagnostics mode=delta` first and names the resolved file second, so you never have to work the layout out by hand (#2521).
 
 **Report contents:**
 
@@ -234,6 +234,42 @@ One event per logical write batch (not per file) — e.g. a single eslint `--fix
 
 **Kill switch:** `PI_LENS_BUS_PUBLISH=0` disables publishing entirely (see `docs/environment-variables.md`). Publishing is fire-and-forget — a disabled/unavailable/throwing bus never affects the write path's own success or latency.
 
+### Bus Events — `pilens:format:*` (#673)
+
+Deferred formatting has a separate lifecycle on the same `pi.events` bus:
+
+```
+pilens:format:queued  { v: 1, source: "pi-lens", filePath, cwd, tool, kinds,
+                        ownerSessionId?, turnIndex?, batchId? }
+pilens:format:start   { v: 1, source: "pi-lens", cwd, paths, fileCount, kinds,
+                        ownerSessionId?, turnIndex?, batchId? }
+pilens:format:done    { v: 1, source: "pi-lens", cwd, paths, fileCount, kinds,
+                        ownerSessionId?, turnIndex?, batchId?, settled? }
+```
+
+Paths and `cwd` are absolute, normalized strings. `queued` is emitted when a
+file first enters the deferred queue; `start` is emitted when a non-empty
+claimed format batch begins; and `done` is emitted after all formatters in that
+batch and any late-write resyncs have settled. `paths: []` on `done` means the
+batch changed no bytes. `batchId` is process-unique and monotonic across
+coordinator generations, so
+two same-millisecond reloads cannot share a lifecycle identity. A normal
+`pilens:format:done` has `settled: true` (or omits the additive field for old
+producers). If the formatter remains unsettled after the bounded hook/format
+drain, pi-lens emits one terminal `pilens:format:done` with `settled: false`
+and the still-pending paths, and records one `deferred-format-unsettled`
+degradation for that batch. A later formatter write is resynced by the late
+continuation and does not emit a second done event.
+The session and turn fields let a listener match the lifecycle to its own
+session and turn; consumers must not infer ownership from paths or timing.
+
+These are visibility events, not a flush API. They are fire-and-forget and can
+be absent when the bus is disabled, unwired, stale, or throws. Replaced-session
+and aborted drains publish only for work they actually claim and finish; work
+requeued for its owner is not
+announced as done by the replacing session. The events are additive v1 schemas
+and may gain optional fields without a version bump.
+
 **Fix provenance (#502):** `FilesTouchedPayload` gained an additive, optional `fixes` field so a diff/review consumer can distinguish a pi-lens-mechanical hunk from an agent edit:
 
 ```

package/node_modules/pi-lens/docs/globalconfig.md

@@ -263,7 +263,7 @@ not corrupt delta baselines.
 
 ### `maxProjectFiles`
 
-Single scale knob (default `2000`) that a large-but-healthy repo can raise to scale five independent size budgets together instead of tripping each one separately: the project-diagnostics scanner (0.25×, default 500 files), the review graph (0.5× up to a point, default 1,000 files — see below), the startup scan (1×, default 2,000 source files), jscpd (3×, default 6,000 directory entries), and the word index (3×, default 6,000 files). Raising it (e.g. to `5000`) scales all five proportionally. Each subsystem's own environment-variable override (e.g. `PI_LENS_REVIEW_GRAPH_MAX_FILES`, `PI_LENS_STARTUP_SCAN_MAX_ENTRIES`) still takes precedence over this knob when set, and a separate `PI_LENS_MAX_PROJECT_FILES` environment variable sits below `maxProjectFiles` but above the built-in default. See `clients/project-scale.ts` for the full ratio table and precedence order.
+Single scale knob (default `2000`) that a large-but-healthy repo can raise to scale five independent size budgets together instead of tripping each one separately: the project-diagnostics scanner (0.25×, default 500 files), the review graph (0.5× up to a point, default 1,000 files — see below), the startup scan (1.25×, default 2,500 source files), jscpd (3×, default 6,000 directory entries), and the word index (3×, default 6,000 files). Raising it (e.g. to `5000`) scales all five proportionally. Each subsystem's own environment-variable override (e.g. `PI_LENS_REVIEW_GRAPH_MAX_FILES`, `PI_LENS_STARTUP_SCAN_MAX_ENTRIES`) still takes precedence over this knob when set, and a separate `PI_LENS_MAX_PROJECT_FILES` environment variable sits below `maxProjectFiles` but above the built-in default. See `clients/project-scale.ts` for the full ratio table and precedence order.
 
 Unlike the other four, the review graph's budget stops scaling flatly at 0.5× once `maxProjectFiles` climbs past 4,000 — it tapers toward a 5,000-file ceiling instead of growing unbounded (#775). Its higher per-file cold-build cost bounds this default file budget independently of the graph's disk-persist circuit-breaker, whose measured default is now 500,000 elements (#936; override with `PI_LENS_GRAPH_PERSIST_MAX_ELEMENTS`). An over-cap graph persists a centrality-ranked partial snapshot with explicit total-versus-persisted coverage; read-only orientation may use it, but incremental builds never reuse it as a complete base. Below the 4,000 threshold (which covers every typical/default-sized project) it's the same flat 0.5× ratio as before. See `reviewGraph.maxFiles` below for an explicit opt-in past the taper.
 

package/node_modules/pi-lens/docs/lsp-capability-matrix.md

@@ -156,6 +156,7 @@ carries the named admission until then.
 | yaml | yaml-language-server | push-only | publishes-unversioned | direct | 2* | dev+ci |
 | shell | bash-language-server | push-only | publishes-versioned | direct | 2 | dev+ci |
 | dockerfile | docker-langserver | push-only | publishes-unversioned | direct | 2* | dev+ci |
+| dockerfile-official | docker-language-server (official) | push-only | unknown | empty-only | ? | dev+ci |
 | toml | taplo | push-only | publishes-unversioned | direct | 2* | dev+ci |
 | terraform | terraform-ls | push-only | publishes-unversioned | empty-first | 2* | dev+ci |
 | prisma | @prisma/language-server | push-only | publishes-unversioned | direct | 2* | dev+ci |
@@ -260,5 +261,5 @@ two-run `clean-behavior` hysteresis and the consecutive-night `idle-eviction`
 counts (#3989). Regenerated every run; never a measurement.
 
 ```json
-{"idle-eviction":{"docker":{"nights":[{"day":"2026-10-07","rssMb":64,"coldMs":566}]},"json":{"nights":[{"day":"2026-10-07","rssMb":67,"coldMs":1116}]},"powershell":{"nights":[{"day":"2026-10-07","rssMb":155,"coldMs":2601}]},"python-jedi":{"nights":[{"day":"2026-10-07","rssMb":51,"coldMs":1796}]},"zizmor":{"nights":[{"day":"2026-10-07","rssMb":58,"coldMs":608}]}}}
+{"clean-behavior":{"dockerfile-official":{"pendingBehavior":"publishes-versioned","pendingTier":"2","runs":1}},"idle-eviction":{"docker":{"nights":[{"day":"2026-10-07","rssMb":64,"coldMs":566}]},"json":{"nights":[{"day":"2026-10-07","rssMb":67,"coldMs":1116}]},"powershell":{"nights":[{"day":"2026-10-07","rssMb":155,"coldMs":2601}]},"python-jedi":{"nights":[{"day":"2026-10-07","rssMb":51,"coldMs":1796}]},"zizmor":{"nights":[{"day":"2026-10-07","rssMb":58,"coldMs":608}]}}}
 ```

package/node_modules/pi-lens/docs/lsp-idle-eviction.md

@@ -46,7 +46,7 @@ step log only, because it flaps.
 | dart | primary | unmeasured | unavailable | tool-unavailable | n/a | n/a |
 | deno | primary | transparent | eligible | · | ok | preserved |
 | docker | primary | unmeasured | eligible | · | ok | preserved |
-| docker-official | primary | unmeasured | unavailable | no-fixture | n/a | n/a |
+| docker-official | primary | unmeasured | eligible | · | ok | preserved |
 | elixir | primary | unmeasured | unavailable | tool-unavailable | n/a | n/a |
 | expert | primary | unmeasured | eligible | · | ok | preserved |
 | fish | primary | transparent | eligible | · | ok | preserved |

package/node_modules/pi-lens/docs/pi-lens-fixer.md

@@ -34,10 +34,11 @@ mechanics"; a brief supplies only `lane=<name>`, scope, and the grant.
   preserves or tightens, and show the violating config red on the pre-fix model
   and green after, or carry `TLA+ unaffected: <family> — <reason>` in the PR
   body. A row is any-of (one listed family's model move or declaration
-  satisfies it); a row of 4+ families only prints a note until hunk-level
-  matching exists (#3878). The map owner is the lane that adds a
-  `formal/<family>/`: it adds the family and its map row in the same PR, and
-  `validateCoverageMap` reds the Unit tests lane otherwise.
+  satisfies it); a row of 4+ families only prints a note, except `index.ts`,
+  whose row gates on the lifecycle hook handler a hunk lands in (#3878). The
+  map owner is the lane that adds a `formal/<family>/`: it adds the family and
+  its map row in the same PR, and `validateCoverageMap` reds the Unit tests lane
+  otherwise.
 - Seams are named in the brief before the round. A fixer that needs an
   unconfirmed seam stops and reports it as a finding, not as a test.
 
@@ -158,7 +159,10 @@ rigor (#2599).
   must pass, and the hand-back quotes them. A red `PR body (advisory)` check is
   a fix-before-review item. A changelog fragment is `---` /
   `section: <Added|Changed|Deprecated|Removed|Fixed|Security>` /
-  `audience: <user|internal>` / `---` / blank / one `- ` bullet. `audience` is
+  `audience: <user|internal>` / `---` / blank / one `- ` bullet. New
+  `audience: user` fragments must begin with a bold lead of at most 100
+  characters, excluding issue references; internal fragments are exempt.
+  `audience` is
   required: `user` is anything a pi-lens user or agent can observe (tools,
   diagnostics, messages, config, install, performance, a fixed bug they could
   hit); `internal` is CI, tests, `formal/`, contributor docs, orchestration, and

package/node_modules/pi-lens/docs/pi-lens-merge-policy.md

@@ -267,7 +267,7 @@ operator's private notes, so a different orchestrator can run the same train.
   | a new fixture under `tests/fixtures/` | the fixture-contract sweeps for that directory (style-preserving, population guards) — #2782 r2 |
   | a change that touches identifier uses of a glossary-retired synonym | run `tests/config/glossary-synonym-sweep.test.ts` on the head AND on the merge with `origin/master`, then re-pin in the PR from the sweep's own `UNPINNED`/`STALE` output — #3279, #3283, #3284, #3288 |
   | a new `vi.mock` in a test file | run `tests/config/vi-mock-export-sweep.test.ts`; whole-module mocks of a production module must spread `importOriginal` — PR #3268's CI red, fixed by trailing commit `621d61c5c` |
-  | a changelog fragment | front matter `section: <Section>` plus `audience: user` or `audience: internal` and exactly one top-level `- **Title (refs #N)** —` entry, never `CHANGELOG.md`, validated by `node scripts/check-changelog-fragments.mjs` — PR #3268 r1 shipped `category:` and a paragraph |
+  | a changelog fragment | front matter `section: <Section>` plus `audience: user` or `audience: internal` and exactly one top-level entry; new user entries open with a bold lead of at most 100 characters (refs excluded), never `CHANGELOG.md`, validated by `node scripts/check-changelog-fragments.mjs` — PR #3268 r1 shipped `category:` and a paragraph |
   | a PR body | the header gate: exactly one-sentence `## Why`, `## Notes for the reviewer`, `## Change outline`, plus Summary / Tests with `### Test assessment` / Blast radius / Class sweep / Observability; run `node scripts/check-pr-body.mjs --lint-local` before pushing — three PRs this week needed orchestrator body edits |
   | a whole-tree docs restructure of `AGENTS.md` | every governance test that reads `AGENTS.md`, with markers on their own lines — PR #3265 r1 |
   | a raw poll in a test | the flake-shape ratchet; the fix is the governed wait, never a header admission — #2781 r1 |
@@ -692,3 +692,45 @@ Each row cost a lane at least once; the prose above carries the record.
 | Enabling auto-merge before local HEAD equals the pushed SHA | Verify the pushed SHA before enabling auto-merge (#3671) |
 | Waiting for CI after retargeting a base without a push | Push after a base retarget to re-arm CI (#3679) |
 | Leaving fork-PR `action_required` runs unapproved | Approve the runs after pushing to a fork PR (#3656) |
+| Writing a closing keyword on a partial delivery | #4021's title said "closes #1513" while its notes said the global-bin walk remained; the merge auto-closed #1513 and it was reopened by hand (2026-10-07). Close only when every acceptance criterion is met; otherwise write `Refs #N` and post the remainder before merging. Title and body must agree |
+| Two writers doing read-modify-write on one shared record without a lock | The orchestrator ledger lost a freshly written row: a sync script read the file, a row was appended, the sync wrote back its stale copy (2026-10-07). Every writer of a shared record holds one lock across the whole read-modify-write (principles §1, "Design shared state once") |
+| Paraphrasing an acceptance criterion into a review brief | A combination-review brief for #3997 said substituted labels "must reject" where they must be accepted when they form an identifier (2026-10-06). Quote the criterion from the PR body or issue; never restate its polarity from memory |
+| Treating a `completed` settlement as delivered when its declared report is missing | Two codex settlements in one batch wrote `REVIEW.md` instead of the declared `REVIEW_4024.md`, or only a GitHub comment (plegma #689; 2026-10-07). Check the declared file exists; else read the file the worker's final line links, and release by hand |
+| Assuming a hook added mid-session is live | A `SubagentStop` hook added to `.claude/settings.local.json` mid-session never fired and did not show under `/hooks` (2026-10-07). Hooks load at session start: confirm under `/hooks` after adding one, or restart before relying on it |
+| Leaving a lane's report inside the checkout that gets torn down | Closing a reviewer's worktree deleted its `REVIEW_4028.md`; the fix round worked from a relayed list (2026-10-07). Reports go outside worktrees (the handbacks directory), and teardown copies any root report out first |
+| Relying on a declared deliverable name the worker never sees | plegma does not pass `deliverables:` into the delivered task; 4 of 4 briefs that omitted the file name got `REVIEW.md` or no file, 2 of 2 that named it were followed (plegma #689; 2026-10-07). Name every declared file in the brief text |
+| Telling a worker to dispatch a workflow without checking what it publishes | A brief asked a fixer to `gh workflow run` its branch; the job publishes `data/test-history` with no ref guard, and the queued run would have pushed unreviewed rollup output with an oldest-row eviction (#4037, cancelled; 2026-10-07). Read the workflow's push and publish steps and their `if:` guards before asking for a branch dispatch |
+| Trusting a `completed` fix round without checking the PR head moved | The #3997 maintainer round settled `completed` while its lease push to the base repo was rejected; the commit sat in the worker tree (plegma #692; 2026-10-07). After each fix round, compare `gh pr view --json headRefOid` with the worker's commit |
+| Raising a timing budget without proving the guard still reds | A request to widen a 300 ms occupancy budget to 500 ms; the yield-removal mutation measured 220 ms locally while healthy CI measured 324–520 ms, so the guard was vacuous at either value (2026-10-07). Mutate the regression the budget exists for before moving the number |
+| Re-running a broad suite after a one-file conflict resolution | A census-conflict merge on #4013 re-ran `tests/scripts` plus governance (~240 files) the reviewer had just run green on the prior head; the 4 affected files already passed (2026-10-07). Run the files the resolution touches; CI runs the rest |
+| Claiming a measured fact from a partial grep | The orchestrator told the maintainer the merge-train warden's last 20 runs "took zero actions"; the grep had counted only update-branch, rerun and cancel calls, and the runs had posted 24 PR comments and 37 label changes (#4105, 2026-10-07). The maintainer decided on the wrong number and had to re-confirm. Count every effect a component can have before calling it inert |
+| Letting one transient backend error re-route a whole day | A single Luna `Selected model is at capacity` failure moved about 15 later fix lanes to Claude Sonnet while codex had 80% weekly budget and 4 free slots; Claude's weekly budget reached 50% (2026-10-07/08). Treat a capacity error as transient, retry on the next dispatch, and check `plegma_quota` before every Claude fixer |
+| Reading CI in a chain whose push silently did nothing | A background chain gated its push on `&&` after a build that never ran, then read the unchanged head's red Windows job as the "fixed head" result and wrote it into #4111's body (2026-10-07). After every push, compare `gh pr view --json headRefOid` with the pushed commit before reading any CI |
+| Diagnosing a red from the first `##[error]` line | #4054's shard-5 red was called "npm registry unreachable"; that line came from a passing stubbed test, and the real failure was a 5 s timeout in check-pr-body.test.ts (#4088, 2026-10-07). Read the FAIL lines; treat annotation lines from stubbed tests as noise |
+| Triggering CI on a bot PR before checking whether a run already exists | land.sh closed and reopened #4084 30 s after an update-branch, before the new run registered, which cancelled the run, and the cancelled aggregate read red (2026-10-07). Reopen only when no run exists for the head after a real wait |
+| Writing a closing keyword where GitHub does not honour it, or by accident | #4121's title said `closes #3873`, which fails the close-keyword check (titles are never honoured); #4094's body said "then fixed #4080", an accidental closing keyword (2026-10-07). Put closing keywords in the body only, and reread the body for `fix(es\|ed) #N` prose |
+| Seeding a group list from the active queue instead of the tracker | The orchestrator's session group held 3 issues while `area:session` had 8 more open p2s, so "is the session group done?" was answered from an incomplete list (2026-10-08). Build a group from the label and the tracker, then subtract what is out of scope |
+| Filing every LOW review finding as an issue | Each review spawned about one follow-up, so the CI group stayed at about 36 open after 16 closures (2026-10-07). Fold or drop LOW findings; file only MEDIUM and above or a reproduced sibling, and give each group a "done when" |
+| No cleanup when lanes end | 78 GB of finished lane trees and a 22 GB leaking test TMPDIR filled the root disk twice; two reviewers lost probe runs and one fixer's test file was truncated (2026-10-07). Remove a lane's trees and TMPDIR when its PR merges, and keep a disk alarm |
+| Deriving the next round from a stale brief or a stale premise | #3871's brief asked for a selection fix #3903 had already shipped, and #3813's assumed every producer was unfixed; both fixers correctly refused to rebuild merged work (2026-10-07). Re-check the premise on current master when a lane starts, not when the issue was filed |
+| Calling a PR-owned hygiene leak pre-existing because the same files fail on a later run | The PR's own CI run exposed the leak, but the reviewer classified it as a flake and fixed an unreachable injected path; the PR review and red-on-base comparison should have owned the finding. The hygiene check now treats a new leak on a green-master PR as CAUSED-BY-PR until red-on-base proves otherwise, and harness children receive a private `TMPDIR` (#4133, #4128). |
+| Passing a commit SHA where a command expected wait seconds | The shell invocation was caught by the command's outcome review; argument-shape validation should have caught it before execution. `land.sh` now validates the wait argument and prints its outcome line. |
+| Losing executable mode in an atomic `.new` to `mv` replacement | The next invocation caught the non-executable script; the file-install check should have compared mode as well as bytes. The replacement now preserves the executable bit. |
+| Reusing a finished PR row for `lane-set --new` | The lane ledger exposed the wrong PR identity; the row allocator should have rejected terminal rows before allocation. New rows now require an unused active identity. |
+| Matching a flake on text that CI never prints | The unmatched CI output was noticed during review; the matcher test should have used a captured CI transcript. The flake matcher now keys on the classifier's actual output. |
+| Letting keyword-title lint contradict the repository convention | The title gate review found the contradiction; the title-convention test should have pinned the accepted form. The lint rule now follows the repository's title convention. |
+| Relaying a shard failure to a fixer without mirroring it on the PR | The fixer noticed the missing scope record; the scope-mirror hook should have rejected the handoff. The handoff path now records the scope on the PR before dispatch. |
+| Treating a repeatedly red advisory lane as harmless | The maintainer's retrospective found the 21% flake after a misleading PR draw; the advisory policy and newest-master comparison should have held the PR. `land.sh` now holds a PR-red/master-green advisory unless `ADVISORY_OK=1`. |
+| Forgetting to arm the landing chain after a trailing fix | A later PR-GREEN event exposed that the fix was waiting unarmed; the trailing-fix command should have verified arming. Rule: after a trailing fix, arm `land.sh` in the same step (not yet mechanised). |
+| Accepting an identity trade-off without a complete timing-cell table | Cloud verification found primary-item loss after the trade-off was accepted from prose; the fixer's state table and review should have enumerated every timing cell. The brief now requires the complete state table before accepting the trade-off. |
+| Letting a scoped test exceed Vitest's default timeout | A repeated cloud review caught the timeout; the local targeted run should have exercised the test under its default timeout. Rule: a scoped review runs new tests under the default Vitest timeout before passing them (not yet mechanised). |
+| Specifying a truncation mechanism instead of an output acceptance criterion | The orchestrator's output read found cut lines after the worker followed the brief; the brief should have stated the required output (complete first sentence, no ellipsis). Rule: acceptance names the required output, not only the mechanism. |
+| Adding a second idle timer without naming the probe consumer | The nightly eviction probe caught the missing configuration coverage; the change's call-tree diff should have listed every idle-timer environment setter. The configuration test now requires every client-read idle timer to be armed by the probe. |
+| Reproducing only one step of a multi-step release-body producer | A user noticed the missing Thanks section; the release-body test should have run the complete producer chain. `bin/relnotes-regen.sh` now runs both steps and refuses to lose the section. |
+| Basing a real-pi premise on an unavailable maintainer-machine probe | The fixer could not rerun the stale probe and the recurrence was found in review; the premise check should have required a repository witness. Fix briefs now require a `tests/real-harness` witness using `withRealPi` and a scripted provider. |
+| Sending a sandboxed verifier a brief path instead of its contents | The verifier reported that the brief was unreadable; the dispatch smoke test should have inspected the delivered argument. Verification now inlines file arguments. |
+| Allowing a mocked handler to throw so every assertion passes vacuously | Verify found the non-blocking degradation; the test double should have failed explicitly when the handler throws. Rule: a test asserting a handler verdict must also assert that no handler-throw degradation was recorded; a shared helper is a candidate, not yet built. |
+| Trusting a worker hand-back that omitted exact test summaries and misreported fixes | Review found nine CAUSED-BY-CHANGE failures and unsupported “fixed” and TLA+ claims; the hand-back check should have required exact summary lines and reviewer red-on-base reruns. Fix lanes now paste the named Vitest summaries and verify identity claims. |
+| Adapting repository fixtures to a Plegma guard failure | Verify caught the harness-specific workaround; the fixture lane should have reported the environment block without changing repository tests. Plegma-guard fixture failures are now reported as environmental. |
+| Reading a piped command's exit status instead of its outcome record | A pending chain was reported as successful because `tail` returned zero; the landing check should have read the chain's own result. `land.sh` now prints `LAND-RESULT #N: <state> (rc=N)`, which callers must read. |
+| Routing a same-seam new defect to a weaker fixer after a prior round | The next verify found the same-seam defect after a Luna-high assignment; round routing should have selected Opus from the seam and round count. Rule: a new same-seam defect after two rounds goes to Opus (cloud fixer when the subscription is short) with the state table and model step first. |

package/node_modules/pi-lens/docs/pi-lens-monitor.md

@@ -29,7 +29,9 @@ memory growth:
   process.externalNonBufferBytes; no tree-count estimate is emitted.
 - subsystems.wordIndex.wireBytes is the UTF-8 length of the word index's JSON,
   taken natively while the snapshot persist encodes the body, and is null
-  until that index's current serialized form is persisted.
+  until that index's current serialized form is persisted, and again once the
+  serialized form is released at `agent_settled` (the `word_index_memo_released`
+  row in latency.log records the release and its trigger).
 - samplerDurationMs measures the sampler's own record-assembly wall time,
   excluding the surrounding turn.
 

package/node_modules/pi-lens/docs/pi-lens-reviewer.md

@@ -100,9 +100,10 @@ Run every probe the diff can trip and say which ran and what each returned.
 - **Model covers the change, not only TLC green (#3802).** When the diff
   touches a file mapped in `formal/coverage-map.json`, require a `.tla`/`.cfg`
   change under any one of the row's families or a `TLA+ unaffected: <family> —
-  <reason>` line for any one of them; rows of 4+ families only print a note. A
-  green `TLA+ models` run over an unchanged model proves nothing about the new
-  code.
+  <reason>` line for any one of them; rows of 4+ families only print a note,
+  except `index.ts`, which gates on the lifecycle hook handler a hunk lands in.
+  A green `TLA+ models` run over an unchanged model proves nothing about the
+  new code.
 - **Red-proof audit.** A claimed red without its quoted transcript is a finding
   of its own; reproduce it (step 3).
 - **Quoted-evidence audit.** Diff every CI line the body quotes against the job