@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/node_modules/pi-lens/dist/clients/blocker-freshness.js

@@ -43,12 +43,32 @@
  * runtime condition — that edge is invisible to this gate, so a blocker whose only
  * stale dependency arrives that way survives a replay. This is an honest boundary,
  * not a silently-closed one.
+ *
+ * Delivery cap (#1950). A demoted-but-confirmable entry (`alreadyStale` above)
+ * is deliberately NOT retired after its past-EOF sibling's one-delivery rule
+ * (#1944, `blocker-past-eof.ts`) — its coordinates are still in bounds, so a
+ * fresh dispatch can genuinely confirm or clear it, and retiring on delivery
+ * one would discard a recoverable finding. But nothing capped how many times
+ * the SAME demoted record re-serves: incident data (#1944's lane sweep) showed
+ * 18 `alreadyStale` re-serves in one window, with repeat deliveries carrying
+ * near-zero information after the first. `runtime-turn.ts` counts each
+ * delivery (`InlineBlockerRecord.staleDeliveryCount`) and retires the record
+ * via `RuntimeCoordinator.retireDemotedDependencyDriftBlocker` once it reaches
+ * `DEPENDENCY_DRIFT_MAX_DELIVERIES` — a count, not a TTL or a session
+ * boundary, because "how many times has the agent already been told" is the
+ * quantity that actually went to zero information, not "how much time has
+ * passed". The ledger reason says "capped, re-run can still confirm" so it
+ * reads distinctly from #1944's "retired, unrecoverable" — a capped record
+ * COULD still resolve a fresh dispatch; it just stopped being handed one for
+ * free.
  */
 import * as fs from "node:fs";
 import { normalizeEphemeralMapKey } from "./path-utils.js";
 import { resolveImportToFiles } from "./review-graph/import-resolvers.js";
 import { getSharedTreeSitterClient, resolveTreeSitterLanguage, } from "./tree-sitter-shared.js";
 import { TreeSitterSymbolExtractor } from "./tree-sitter-symbol-extractor.js";
+/** See the module doc's "Delivery cap (#1950)" section above. */
+export const DEPENDENCY_DRIFT_MAX_DELIVERIES = 3;
 /**
  * Upper bound on the number of forward imports stat-checked for a single blocker.
  * Blocking entries are rare, but one file can import many modules; the sweep must

package/node_modules/pi-lens/dist/clients/bounded-telemetry.js

@@ -24,10 +24,9 @@
  *    that must re-arm at `session_start` and will eventually be forgotten
  *    (the #1266–#1625 defect class).
  * 2. **A per-turn cap names its turn.** `capPerTurn` carries the caller's
- *    `turnIndex` in the same object as the limit, so there is no separate
- *    reset to wire and forget: the counters clear when the observed turn
- *    changes. This is the same lazy clear-on-transition shape as
- *    `noteImportResolutionMemoTurn` (`clients/blocker-freshness.ts`).
+ *    `turnIndex` in the same object as the limit. A bounded 64-turn window
+ *    keeps overlapping async turns independent; results older than that window
+ *    fail closed. Session start clears the window when numbering restarts.
  * 3. **Identity always survives.** Every emitted record carries the
  *    discriminating identity in `filePath` and in `metadata.identity`, so
  *    aggregation can still answer "which file, which method, which record is
@@ -85,6 +84,14 @@ export const BOUNDED_TELEMETRY_PHASES = [
      * exact count.
      */
     "lsp_warm_client_missing",
+    /** #2052: a file's nearest LSP root is outside the session ceiling. */
+    "lsp_capability_skip",
+    /**
+     * #2044: failed-first test state was retired after a confirmed missing path,
+     * retained because the filesystem verdict was indeterminate, or evicted at
+     * the state cap. Selection checks and detailed rows are both capped per turn.
+     */
+    "test_runner_failed_target_state",
     /**
      * #1723: an event-loop block at or above the floor. Not a degradation, so
      * no ledger kind; bounded by call cadence (one `turn_end` runs it once per
@@ -97,6 +104,17 @@ export const BOUNDED_TELEMETRY_PHASES = [
      * queue of them, so it is rising-edge per event name.
      */
     "session_event_stale_ctx_skip",
+    /**
+     * #2007: a worktree-mutating git command declined because another live
+     * session shares this dirty checkout. Rising edge per checkout root; the
+     * ledger keeps the exact repeat count.
+     */
+    "shared_checkout_switch_blocked",
+    /**
+     * #2007: `git status` could not report the working-tree state, so the same
+     * command was declined on an UNKNOWN rather than assumed clean.
+     */
+    "shared_checkout_probe_failed",
 ];
 const REGISTERED_PHASES = new Set(BOUNDED_TELEMETRY_PHASES);
 /** Report whether a phase name is in the registry (used by the sweep). */
@@ -104,14 +122,15 @@ export function isBoundedTelemetryPhase(phase) {
     return REGISTERED_PHASES.has(phase);
 }
 /**
- * Per-turn admission counters, keyed by phase. Cleared lazily when a call
- * observes a turn index different from the one the counters were built for,
- * and eagerly by `resetBoundedTelemetry` at `session_start` (a new session
- * restarts turn numbering at 0, so the lazy check alone could carry a stale
- * count across a session boundary that happened to land on the same index).
+ * Per-turn admission counters, keyed by turn and phase. Multiple turns remain
+ * live because async work can finish T1 after T2 has already emitted. The map
+ * retains a bounded recent window; work older than that window fails closed
+ * rather than reopening an exhausted budget. Session start clears all state.
  */
+const MAX_TRACKED_TURN_CAPS = 64;
 let turnCounts = new Map();
-let countedTurnIndex;
+let latestCountedTurnIndex;
+let retiredThroughTurnIndex = Number.NEGATIVE_INFINITY;
 /**
  * Decide whether this occurrence earns a detailed record, and count it in the
  * ledger either way. Returns `true` when the caller should write the record.
@@ -180,14 +199,25 @@ export function emitBounded(phase, identity, payload, options = {}) {
 function admitAgainstTurnCap(phase, cap) {
     if (cap === undefined)
         return true;
-    if (countedTurnIndex !== cap.turnIndex) {
-        turnCounts = new Map();
-        countedTurnIndex = cap.turnIndex;
+    if (cap.turnIndex <= retiredThroughTurnIndex)
+        return false;
+    let counts = turnCounts.get(cap.turnIndex);
+    if (!counts) {
+        if (turnCounts.size >= MAX_TRACKED_TURN_CAPS) {
+            const oldestTrackedTurn = Math.min(...turnCounts.keys());
+            if (cap.turnIndex < oldestTrackedTurn)
+                return false;
+            turnCounts.delete(oldestTrackedTurn);
+            retiredThroughTurnIndex = Math.max(retiredThroughTurnIndex, oldestTrackedTurn);
+        }
+        counts = new Map();
+        turnCounts.set(cap.turnIndex, counts);
     }
-    const used = turnCounts.get(phase) ?? 0;
+    latestCountedTurnIndex = Math.max(latestCountedTurnIndex ?? cap.turnIndex, cap.turnIndex);
+    const used = counts.get(phase) ?? 0;
     if (used >= cap.limit)
         return false;
-    turnCounts.set(phase, used + 1);
+    counts.set(phase, used + 1);
     return true;
 }
 /**
@@ -198,9 +228,16 @@ function admitAgainstTurnCap(phase, cap) {
  */
 export function resetBoundedTelemetry() {
     turnCounts = new Map();
-    countedTurnIndex = undefined;
+    latestCountedTurnIndex = undefined;
+    retiredThroughTurnIndex = Number.NEGATIVE_INFINITY;
+}
+/** Test-only: one turn's live admission count for a phase. */
+export function _boundedTurnCountForTest(phase, turnIndex = latestCountedTurnIndex) {
+    if (turnIndex === undefined)
+        return 0;
+    return turnCounts.get(turnIndex)?.get(phase) ?? 0;
 }
-/** Test-only: the live per-turn admission count for a phase. */
-export function _boundedTurnCountForTest(phase) {
-    return turnCounts.get(phase) ?? 0;
+/** Test-only: number of turn buckets retained by the bounded counter. */
+export function _boundedTrackedTurnsForTest() {
+    return turnCounts.size;
 }

package/node_modules/pi-lens/dist/clients/build-identity.js

@@ -0,0 +1,95 @@
+/**
+ * #1775: `sessionstart.log` recorded no build identity — no commit hash, no
+ * build timestamp. Dogfood forensics ("does this session include PR #1727?")
+ * had to reconstruct that by hand: run `git merge-base --is-ancestor` in the
+ * serving checkout and compare `dist/` mtimes against the session-start time.
+ *
+ * The running extension can be a different checkout than the repo an
+ * investigator is looking at, so identity is derived from the RUNNING
+ * build's own files — `getPackageRoot` (already used by grammar-source.ts to
+ * find pi-lens's own assets under both the unbundled dev layout and a
+ * packaged install) plus the mtime of the very entry file that is executing
+ * right now — never from `process.cwd()` and never assumed to be a git
+ * checkout.
+ *
+ * Commit resolution reuses `review-graph/git-identity.ts`'s
+ * `resolveGitIdentity` — a PURE filesystem read, no `git` subprocess. This
+ * runs inside the `session_start` handler, ahead of the #473
+ * concurrent-secondary classification, so every in-process subagent pays
+ * whatever this costs; a synchronous `git rev-parse`/`git status` spawn pair
+ * (fix round 1's approach, reverted here) measured 150-300ms typical and up
+ * to ~10s worst case on two 5s timeouts. `resolveGitIdentity` is a handful of
+ * `fs.readFileSync` calls, LRU-cached per process, so this path never spawns.
+ *
+ * The dirty working-tree flag genuinely needs `git status`, which has no
+ * spawn-free equivalent — so it is dropped from this record rather than
+ * reintroducing a spawn on the session-start hot path (refs #1775 followup
+ * comment: dirty flag deferred, commit + entryMtime + version shipped).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isTestMode } from "./env-utils.js";
+import { getPackageRoot } from "./package-root.js";
+import { normalizeFilePath } from "./path-utils.js";
+import { resolveGitIdentity } from "./review-graph/git-identity.js";
+/**
+ * A `.git` found by walking up from `root` only counts as owning `root` when
+ * its resolved worktree top-level IS `root` — not merely an ancestor of it.
+ * Without this check, a packaged install nested anywhere under an unrelated
+ * repo (a dotfiles checkout in $HOME is the common case) would confidently
+ * report that repo's HEAD as the running build's identity.
+ */
+function resolveOwnedCommit(root) {
+    const identity = resolveGitIdentity(root);
+    if (!identity)
+        return "unknown";
+    const normalizedRoot = normalizeFilePath(path.resolve(root));
+    if (identity.worktreeRoot !== normalizedRoot)
+        return "unknown";
+    return identity.headCommit.slice(0, 8);
+}
+function readPackageVersion(root) {
+    try {
+        const raw = fs.readFileSync(path.join(root, "package.json"), "utf-8");
+        const pkg = JSON.parse(raw);
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+function statEntryMtime(entryImportMetaUrl) {
+    try {
+        return fs.statSync(fileURLToPath(entryImportMetaUrl)).mtime.toISOString();
+    }
+    catch {
+        // Entry path unresolvable (e.g. a non-file:// URL) — "unknown" rather
+        // than throw out of a session-start observability line.
+        return "unknown";
+    }
+}
+/**
+ * Resolve the identity of the build currently running — pure filesystem
+ * reads, no subprocess. `entryImportMetaUrl` must be the ENTRY module's own
+ * `import.meta.url` (index.ts) — passing a different module's URL would
+ * report that module's mtime instead of the running build's.
+ *
+ * Returns `undefined` inside the test runner: nothing computed, nothing
+ * logged (`sessionstart-logger`'s writer is a no-op there too), so a caller
+ * on the session-start hot path never pays this cost during tests.
+ */
+export function getBuildIdentity(entryImportMetaUrl) {
+    if (isTestMode())
+        return undefined;
+    const root = getPackageRoot(entryImportMetaUrl);
+    return {
+        commit: resolveOwnedCommit(root),
+        entryMtime: statEntryMtime(entryImportMetaUrl),
+        version: readPackageVersion(root),
+    };
+}
+/** One bounded, human-readable line for sessionstart.log's free-text writer. */
+export function formatBuildIdentity(identity) {
+    return `session_start: build identity — commit=${identity.commit} entryMtime=${identity.entryMtime} version=${identity.version}`;
+}

package/node_modules/pi-lens/dist/clients/bus-publish.js

@@ -23,6 +23,7 @@ import { appendRecentTouches } from "./recent-touches.js";
 import { createLiveBusEmitter, recordStaleBusFailure, resolveLiveBusEmitter, } from "./live-bus-emitter.js";
 export const BUS_FILES_TOUCHED_EVENT = "pilens:files:touched";
 export const BUS_FILES_TOUCHED_VERSION = 1;
+const BUS_LOG_PATH_CAP = 64;
 const liveEmitter = createLiveBusEmitter();
 let hasLoggedFailure = false;
 // Log-once-per-process guards for the two structural-no-op outcomes below
@@ -148,6 +149,8 @@ export function publishFilesTouched(args) {
             cwd: payload.cwd,
             reason: args.reason,
             fileCount: payload.paths.length,
+            writer: "pi-lens",
+            paths: payload.paths.slice(0, BUS_LOG_PATH_CAP),
         });
     }
     catch (err) {

package/node_modules/pi-lens/dist/clients/cache/rule-cache.js

@@ -11,6 +11,7 @@ import { getProjectDataDir } from "../file-utils.js";
 import { readJsonCache } from "../json-cache-read.js";
 import { resolvePackagePath } from "../package-root.js";
 import { writeFileAtomic } from "../atomic-write.js";
+import { compareOrdinal } from "../string-utils.js";
 // v4: cache skip_test_files + fix_action — v3 entries silently dropped them,
 // and ruleHash (rule-file mtimes) never invalidates on a code-only fix.
 // v5 (#675): rule SELECTION changed in code — javascript no longer inherits the
@@ -69,7 +70,7 @@ export class RuleCache {
     }
     computeRuleHash(ruleFiles) {
         const hash = crypto.createHash("sha256");
-        for (const file of ruleFiles.sort((a, b) => a.localeCompare(b))) {
+        for (const file of ruleFiles.sort(compareOrdinal)) {
             const resolved = path.resolve(file);
             if (!fs.existsSync(resolved))
                 continue;

package/node_modules/pi-lens/dist/clients/cache-observability.js

@@ -50,6 +50,7 @@
 import { createHash } from "node:crypto";
 import { lazyEnvNumber } from "./env-utils.js";
 import { logLatency } from "./latency-logger.js";
+import { compareOrdinal } from "./string-utils.js";
 /** RuntimeCoordinator's counter is process-global when sessions share a host. */
 const PROCESS_TURN_SCOPE = "process-global-runtime";
 const SECONDARY_TURN_SCOPE = "unavailable-concurrent-secondary";
@@ -490,7 +491,7 @@ function boundedHashArray(value, depth, seen, state) {
     return `array:${value.length}:[${items.join(",")}]`;
 }
 function boundedHashObject(value, depth, seen, state) {
-    const keys = Object.keys(value).sort((left, right) => left.localeCompare(right));
+    const keys = Object.keys(value).sort((left, right) => compareOrdinal(left, right));
     if (keys.length > 24)
         state.contentTruncated = true;
     const fields = keys

package/node_modules/pi-lens/dist/clients/cascade-logger.js

@@ -3,17 +3,31 @@ import { isTestMode } from "./env-utils.js";
 import { getGlobalPiLensDir } from "./file-utils.js";
 import { createNdjsonLogger } from "./ndjson-logger.js";
 import { getMaxLogSizeMB } from "./log-cleanup.js";
+import { normalizeLoggedPath } from "./path-utils.js";
 const CASCADE_LOG_DIR = getGlobalPiLensDir();
 const CASCADE_LOG_FILE = path.join(CASCADE_LOG_DIR, "cascade.log");
 const writer = createNdjsonLogger({
     filePath: CASCADE_LOG_FILE,
     maxBytes: getMaxLogSizeMB() * 1024 * 1024,
 });
+/**
+ * #2219 (the #2141 class): call sites across `dispatch/integration.ts`,
+ * `runtime-turn.ts`, and `runtime-coordinator.ts` feed a mix of raw
+ * `filePath`/`cwd` params and (for `lsp/cascade-tier.ts`) the
+ * `"<quiet-window>"` sentinel. Normalize once here, the single emit seam —
+ * same pattern as `review-graph-logger.ts`'s `logReviewGraph`, guarded via
+ * `normalizeLoggedPath` so the non-path sentinel passes through unchanged
+ * instead of being resolved against the process cwd.
+ */
 export function logCascade(entry) {
     if (isTestMode()) {
         return;
     }
-    writer.log({ ts: new Date().toISOString(), ...entry });
+    writer.log({
+        ts: new Date().toISOString(),
+        ...entry,
+        filePath: normalizeLoggedPath(entry.filePath),
+    });
 }
 export function getCascadeLogPath() {
     return CASCADE_LOG_FILE;

package/node_modules/pi-lens/dist/clients/dead-code-client.js

@@ -101,9 +101,9 @@ export function parseVultureOutput(output, root) {
  *
  * vulture finds unused functions, classes, methods, imports, variables and
  * attributes by static analysis of the whole tree. It has no JSON reporter, so
- * we parse its stable one-line-per-finding text output. It exits 1 when it
- * FINDS dead code (linter convention), so a non-zero exit with parseable
- * output is success, not failure.
+ * we parse its stable one-line-per-finding text output. A clean run exits 0;
+ * found dead code exits 3 with findings on stdout. A non-zero exit with
+ * parseable output is success, not failure (see runAnalyze for the table).
  */
 export class PythonDeadCodeClient {
     id = "python";
@@ -245,6 +245,7 @@ export class PythonDeadCodeClient {
                     latched: true,
                     hostStallMs,
                     budgetMs: 5000,
+                    classifiedBy: "probe",
                 });
                 return true;
             }
@@ -370,14 +371,16 @@ export class PythonDeadCodeClient {
                 durationMs,
             };
         }
-        // vulture writes parse/usage errors to stderr and exits 1 with no
-        // stdout findings; distinguish that from "found dead code" (exit 1 WITH
-        // findings on stdout). #1736 sweep: the ORIGINAL guard here required
-        // non-empty stderr to call it an error, so a nonzero exit with BOTH
-        // empty stdout and empty stderr (a silent crash) still fell through to
-        // "No dead code found" -- the same empty-distinguishes-clean-from-errored
-        // gap the knip fix closes. A nonzero exit with no findings on stdout is
-        // never clean now, regardless of whether stderr said anything.
+        // Verified exit-code table (vulture 2.16, probed live during the #1758
+        // review): a clean run exits 0 with empty stdout; dead code found exits
+        // 3 with findings on stdout; invalid input or a parse error exits 1
+        // with empty stdout and the error on stderr. #1736 sweep: the ORIGINAL
+        // guard here required non-empty stderr to call it an error, so a
+        // nonzero exit with BOTH empty stdout and empty stderr (a silent crash)
+        // still fell through to "No dead code found" -- the same
+        // empty-distinguishes-clean-from-errored gap the knip fix closes. A
+        // nonzero exit with no findings on stdout is never clean now,
+        // regardless of whether stderr said anything.
         const output = result.stdout || "";
         if (!output.trim()) {
             const stderr = (result.stderr || "").trim();

package/node_modules/pi-lens/dist/clients/degradation-ledger.js

@@ -3,6 +3,12 @@ import { logExtension } from "./extension-log.js";
 import { LEDGER_FIELD_MAX, truncateForLedger } from "./ledger-bounds.js";
 import { logLatency } from "./latency-logger.js";
 import { getSinkWriteFailures, resetSinkWriteFailures, } from "./ndjson-logger.js";
+// #2146: pulled at READ time, never pushed. `process-singletons.ts` is a
+// dependency leaf on purpose — it cannot import this module without closing a
+// no-client-cycles cycle through instance-registry/instance-reaper — so the
+// ledger reaches IN for its reset log, the same inversion `getSinkWriteFailures`
+// above uses.
+import { getProcessSingletonResets, PROCESS_SINGLETON_RESET_KIND, } from "./process-singletons.js";
 // Re-exported so existing importers keep one name for the ledger's bound.
 export { LEDGER_FIELD_MAX, truncateForLedger };
 const ENTRIES_PER_KIND = 20;
@@ -59,7 +65,7 @@ export function recordDegradationOnce(record) {
             return;
         onceKeys.add(key);
         if (recordDegradation({ kind, subject, reason: record.reason })) {
-            logDurableDegradation(kind, subject, 1);
+            logDurableDegradation(kind, subject, 1, record.metadata);
         }
     }
     catch (error) {
@@ -108,7 +114,7 @@ export function incrementDegradationCount(record) {
         // Durable rows use the summary's admission and emit the first event and
         // power-of-two milestones only, keeping the sink bounded.
         if (admitted && isPowerOfTwo(count)) {
-            logDurableDegradation(kind, subject, count);
+            logDurableDegradation(kind, subject, count, record.metadata);
         }
         return count === 1;
     }
@@ -124,15 +130,34 @@ export function incrementDegradationCount(record) {
  * redaction, and write queue. The subject and kind were already bounded by the
  * ledger before reaching this seam.
  */
-function logDurableDegradation(kind, subject, count) {
+function logDurableDegradation(kind, subject, count, metadata) {
+    const boundedMetadata = boundLedgerMetadata(metadata);
     logLatency({
         type: "phase",
         phase: "degradation_ledger",
         filePath: subject,
         durationMs: 0,
-        metadata: { kind, subject, count, ledgerGeneration },
+        metadata: {
+            ...boundedMetadata,
+            kind,
+            subject,
+            count,
+            ledgerGeneration,
+        },
     });
 }
+const MAX_METADATA_KEYS = 8;
+function boundLedgerMetadata(metadata) {
+    if (!metadata)
+        return {};
+    const entries = Object.entries(metadata);
+    const kept = entries.slice(0, MAX_METADATA_KEYS);
+    const bounded = Object.fromEntries(kept.map(([key, value]) => [key, truncateForLedger(value)]));
+    const dropped = entries.length - kept.length;
+    if (dropped > 0)
+        bounded.metadataDropped = dropped;
+    return bounded;
+}
 function isPowerOfTwo(value) {
     return value > 0 && (value & (value - 1)) === 0;
 }
@@ -165,6 +190,21 @@ export function getDegradationSummary() {
             })),
         });
     }
+    // #2146, same read-time fold: process-singleton resets live in the leaf
+    // module's own bounded log. One entry per family, so this group's count is
+    // the number of families this build could not adopt, never an event tally.
+    const singletonResets = getProcessSingletonResets();
+    if (singletonResets.length > 0) {
+        summary.push({
+            kind: PROCESS_SINGLETON_RESET_KIND,
+            count: singletonResets.length,
+            droppedCount: 0,
+            latestReasons: singletonResets.map((reset) => ({
+                subject: truncateForLedger(reset.family),
+                reason: truncateForLedger(reset.reason),
+            })),
+        });
+    }
     return summary;
 }
 function isRenderableSummary(value) {
@@ -218,6 +258,18 @@ export function resetDegradationLedger() {
     // process-lifetime latch too — it re-arms alongside the rest of the
     // ledger rather than surviving past the session that observed it.
     resetSinkWriteFailures();
+    // #2146 review F3: the OTHER pulled source, `getProcessSingletonResets()`,
+    // deliberately does NOT re-arm here, and the difference from its neighbour
+    // above is the point. A sink write failure recurs — new writes fail, so
+    // clearing the tally costs nothing and a later session re-observes the
+    // problem. A process-singleton reset happens once, at module-evaluation
+    // time, and cannot recur: after it, the container holds only compatible
+    // cells. Clearing it would show the fact in the first session's
+    // `pilens_health` and hide it from every session after, which is exactly
+    // when someone reads that line. The row is bounded independently of the
+    // session (one entry per family, capped at 16), so leaving it costs a fixed
+    // handful of lines and keeps a process-scope fact visible for the process's
+    // life. Deliberate exception to catalog shape 17, not an oversight.
 }
 export const DEGRADATION_ENTRIES_PER_KIND = ENTRIES_PER_KIND;
 export const DEGRADATION_MAX_DISTINCT_KINDS = MAX_DISTINCT_KINDS;

package/node_modules/pi-lens/dist/clients/demoted-finding-render.js

@@ -153,3 +153,17 @@ export function formatRetirementNote(deadLines) {
     return (`Retired after this delivery${cited}: the file no longer has these lines, ` +
         "so this finding cannot be re-confirmed and will not be served again.");
 }
+/**
+ * The one-line note a surface appends when it RETIRES a dependency-drift
+ * demotion at its delivery cap (#1950). Deliberately worded differently from
+ * {@link formatRetirementNote}: that one means the finding is provably
+ * unrecoverable (the cited lines are gone), while THIS retirement is a
+ * bounded-noise cap on a record that is still recoverable — a fresh dispatch
+ * of the file could still confirm or clear it. Saying "cannot be re-confirmed"
+ * here would be false.
+ */
+export function formatDeliveryCapNote(deliveryCount) {
+    return (`Not shown again after ${deliveryCount} deliveries with no re-run: ` +
+        "this finding may still be accurate, but re-serving it further adds no " +
+        "new information. A fresh dispatch of this file will re-confirm or clear it.");
+}

package/node_modules/pi-lens/dist/clients/dependency-checker.js

@@ -14,6 +14,7 @@ import * as path from "node:path";
 import { findNodeToolBinary } from "./package-manager.js";
 import { isFullyQualified } from "./path-utils.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { compareOrdinal } from "./string-utils.js";
 import { createAvailabilityChecker, discoverManagedTool, getManagedToolEnvironment, resolveAvailableOrInstall, } from "./dispatch/runners/utils/runner-helpers.js";
 import { createAvailabilityLatch, } from "./dispatch/runners/utils/availability-policy.js";
 /**
@@ -501,8 +502,14 @@ export class DependencyChecker {
         const existing = this.checkInFlight.get(key);
         if (existing)
             return existing;
+        // Identity-guarded release (#1968's pattern): delete only if THIS run is
+        // still the registered one. A bare delete-by-key lets a late-settling run
+        // evict a live successor a second writer registered under the same key
+        // mid-flight, after which the next caller starts a duplicate check.
         const promise = this.runCheckFile(normalized, projectRoot, gen).finally(() => {
-            this.checkInFlight.delete(key);
+            if (this.checkInFlight.get(key) === promise) {
+                this.checkInFlight.delete(key);
+            }
         });
         this.checkInFlight.set(key, promise);
         return promise;
@@ -781,8 +788,14 @@ export class DependencyChecker {
         // does, and the two overlap (runtime-session, fresh-fetch), so it takes a
         // generation too — claimed before the spawn, as late as a scan can.
         const gen = ++this.opGeneration;
+        // Identity-guarded release (#1968's pattern): delete only if THIS run is
+        // still the registered one. A bare delete-by-key lets a late-settling run
+        // evict a live successor a second writer registered under the same key
+        // mid-flight, after which the next caller starts a duplicate scan.
         const promise = this.runScanProject(projectRoot, gen).finally(() => {
-            this.scanInFlight.delete(projectRoot);
+            if (this.scanInFlight.get(projectRoot) === promise) {
+                this.scanInFlight.delete(projectRoot);
+            }
         });
         this.scanInFlight.set(projectRoot, promise);
         return promise;
@@ -830,7 +843,11 @@ export class DependencyChecker {
         const seen = new Set();
         let output = `[Circular Deps] ${circular.length} cycle(s) found:\n`;
         for (const dep of circular) {
-            const cycleKey = dep.path.sort((a, b) => a.localeCompare(b)).join("→");
+            // Copy before sorting: `dep.path` is rendered verbatim below (and by
+            // other CircularDep consumers, e.g. madge.ts's diagnostic renderer),
+            // so the dedupe key must not reorder — let alone mutate in place —
+            // the path a user reads.
+            const cycleKey = [...dep.path].sort(compareOrdinal).join("→");
             if (seen.has(cycleKey))
                 continue;
             seen.add(cycleKey);

package/node_modules/pi-lens/dist/clients/deps/minimatch.js

@@ -1,4 +1,4 @@
 /**
  * Centralized accessor for `minimatch`. See ./typescript.ts for the rationale.
  */
-export { minimatch } from "minimatch";
+export { minimatch, Minimatch } from "minimatch";

package/node_modules/pi-lens/dist/clients/dispatch/collect-later-tier.js

@@ -0,0 +1,39 @@
+/** Observed-latency classification shared by dispatch and LSP tier seams. */
+import { normalizeMapKey } from "../path-utils.js";
+/** A runner gets this much time before the next run moves off the write path. */
+export const COLLECT_LATER_THRESHOLD_MS = 5_000;
+const slowRunners = new Map();
+function key(projectRoot, runnerId) {
+    return `${normalizeMapKey(projectRoot)}\u0000${runnerId}`;
+}
+/** Read the current observed tier. Missing observations stay inline. */
+export function classifyObservedRunner(projectRoot, runnerId) {
+    return slowRunners.has(key(projectRoot, runnerId))
+        ? "collect-later"
+        : "inline";
+}
+/** Record one completed latency observation and return the resulting tier. */
+export function observeRunnerLatency(options) {
+    const normalizedProjectRoot = normalizeMapKey(options.projectRoot);
+    const runnerKey = key(normalizedProjectRoot, options.runnerId);
+    if (options.timedOut === true ||
+        options.durationMs > COLLECT_LATER_THRESHOLD_MS) {
+        slowRunners.set(runnerKey, {
+            projectRoot: normalizedProjectRoot,
+            runnerId: options.runnerId,
+        });
+        return "collect-later";
+    }
+    // A fast completed run is affirmative recovery, not merely absence of a
+    // failure. This deliberately prevents a process-lifetime latch.
+    slowRunners.delete(runnerKey);
+    return "inline";
+}
+/** Session boundary reset. */
+export function resetObservedRunnerLatency() {
+    slowRunners.clear();
+}
+/** Test-only inspection without exposing mutable state. */
+export function observedRunnerTierForTests(projectRoot, runnerId) {
+    return classifyObservedRunner(projectRoot, runnerId);
+}