@herbertgao/pi-extensions 2026.8.4 → 2026.8.6

package/node_modules/pi-lens/dist/clients/lsp/index.js

@@ -11,25 +11,69 @@ import { createHash } from "node:crypto";
 import * as nodeFs from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { pathToFileURL, URL } from "node:url";
 import { getProjectIgnoreMatcher, isExcludedDirName, } from "../file-utils.js";
 import { recordLsp } from "../widget-state.js";
 import { applyAuxiliarySuppressions } from "../dispatch/auxiliary-lsp.js";
 import { detectFileRole } from "../file-role.js";
 import { logLatency } from "../latency-logger.js";
 import { logSessionStart } from "../sessionstart-logger.js";
+import { incrementDegradationCount, recordDegradation, recordDegradationOnce, } from "../degradation-ledger.js";
+import { isLspSpawnAllowedByTrust, assertInstallAllowed, projectTrustDenialReason, } from "../project-trust.js";
 import { shouldPreferPullOnlyDiagnostics } from "../lsp-budget.js";
 import { withDeadline } from "../deadline-utils.js";
-import { isAtOrAboveHomeDir, normalizeMapKey, uriToPath, } from "../path-utils.js";
+import { isAtOrAboveHomeDir, isWindowsPath, normalizeMapKey, uriToPath, } from "../path-utils.js";
+import { recordLspMutation, } from "../lsp-mutation.js";
 import { createLSPClient } from "./client.js";
+import { bindingStateLabel, composeBoundToCurrentDisk, createDiskBindingCache, touchCoverageGap, } from "./diagnostic-binding.js";
 import { getServersForFileWithConfig, getServerInitOverride } from "./config.js";
 import { getLanguageId } from "./language.js";
-import { LSP_SERVERS, isDirectLspCommandTemporarilyUnavailable, } from "./server.js";
+import { LSP_SERVERS, enforceLspRootCeiling, hasProjectBoundaryMarker, isDirectLspCommandTemporarilyUnavailable, } from "./server.js";
 import { classifyCascadeWaitTier, classifyServerWaitTier, getStrategy, } from "./wait-policy/index.js";
 import { raceToCompletion } from "./aggregation.js";
-import { applyWorkspaceEdit, mergeWorkspaceTextEditsByPriority, summarizeWorkspaceEdit, } from "./edits.js";
+import { applyWorkspaceEdit, mergeWorkspaceTextEditsByPriority, summarizeWorkspaceEdit, validateWorkspaceEdit, } from "./edits.js";
 import { buildScopeKey, createWorkspaceDiagnosticsCacheContext, } from "./workspace-diagnostics-cache.js";
 import { attemptTsserverSyncDiagnostics, } from "./tsserver-sync.js";
 import { isWarmAttached, tryWarmAttachedDiagnostics, } from "../warm-attach.js";
+function destinationUriPreservingSpelling(oldUri, oldFilePath, newFilePath) {
+    const canonical = pathToFileURL(newFilePath);
+    try {
+        const original = new URL(oldUri);
+        const authority = /^file:\/\/([^/]*)/i.exec(oldUri)?.[1] ?? "";
+        if (original.protocol !== "file:" ||
+            (original.host !== "" && original.hostname !== "localhost")) {
+            return canonical.href;
+        }
+        const canonicalDestination = () => `${original.protocol}//${authority}${canonical.pathname}`;
+        const oldParent = path.resolve(path.dirname(oldFilePath));
+        const newParent = path.resolve(path.dirname(newFilePath));
+        if (normalizeMapKey(oldParent) !== normalizeMapKey(newParent)) {
+            return canonicalDestination();
+        }
+        const slash = original.pathname.lastIndexOf("/");
+        if (slash < 0)
+            return canonicalDestination();
+        let rawName = canonical.pathname.slice(canonical.pathname.lastIndexOf("/") + 1);
+        const oldRawName = original.pathname.slice(slash + 1);
+        const oldName = decodeURIComponent(oldRawName);
+        const expectedOldName = path.basename(oldFilePath);
+        if (oldName.toLowerCase() !== expectedOldName.toLowerCase()) {
+            return canonicalDestination();
+        }
+        // Keep non-canonical percent-encoding choices from the URI that was
+        // opened (for example `%2E` instead of `.`) while using the new path's
+        // exact basename. The authority and directory spelling are preserved too.
+        for (const match of oldRawName.matchAll(/%([0-9a-f]{2})/gi)) {
+            const encoded = match[0];
+            const decoded = String.fromCharCode(Number.parseInt(match[1], 16));
+            rawName = rawName.split(decoded).join(encoded);
+        }
+        return `${original.protocol}//${authority}${original.pathname.slice(0, slash + 1)}${rawName}`;
+    }
+    catch {
+        return canonical.href;
+    }
+}
 // --- Init override helpers ---
 /**
  * Recursively merges `override` onto `base`. Override wins on leaf conflicts
@@ -69,6 +113,41 @@ export function mergeInitializationOptions(base, override) {
 const BROKEN_BASE_COOLDOWN_MS = 15_000;
 const BROKEN_MAX_COOLDOWN_MS = 5 * 60_000; // cap at 5 minutes
 const BROKEN_PERMANENT_AFTER = 5; // disable for session after N consecutive failures
+// #1127: a client that dies THIS soon after a successful spawn/initialize is
+// treated as a crash-loop symptom (opengrep's post-init "Unhandled message"
+// exit), not a legitimate long-running server that happened to restart once.
+// 60s comfortably covers normal serve-a-few-files-then-idle sessions while
+// still catching "spawns fine, dies within seconds every time" servers.
+const RUNTIME_EXIT_UPTIME_THRESHOLD_MS = 60_000;
+// #1142: the fast path above only trips on CONSECUTIVE exits UNDER the 60s
+// threshold, so a server that reliably dies just PAST it (~65-90s after every
+// spawn) resets that streak on every death and churns forever — a persistent
+// low-frequency crash loop the hard-cutoff design structurally cannot see. The
+// windowed-rate trip COMPOSES with (does not replace) the fast path: N
+// non-intentional deaths within a rolling M-minute window trip the breaker
+// regardless of each death's individual lifetime.
+//   N = BROKEN_PERMANENT_AFTER (5): one uniform "5 strikes" give-up count
+//       across both streams, and high enough that the benign over-threshold
+//       deaths that reach this path (a one-off crash after a long healthy run;
+//       a single sleep/resume connection drop) — at most one per key per event
+//       — cannot approach it.
+//   M = 15 min: wide enough for a genuine slow loop (each life ~65-90s, so 5
+//       death→respawn cycles land in ~6-15 min of active churn) to accumulate
+//       5, yet short enough that sparse benign crashes (e.g. "twice last hour,
+//       now healthy") age out of the rolling window before five ever coincide.
+const RUNTIME_EXIT_WINDOW_MS = 15 * 60_000;
+const RUNTIME_EXIT_WINDOW_TRIP_COUNT = BROKEN_PERMANENT_AFTER;
+// A death whose measured lifetime (`exitedAt - spawnedAt`) exceeds this ceiling
+// is NOT recorded toward the window: it is either a genuinely long healthy run
+// that crashed once, or a lifetime computed ACROSS a machine-sleep / Modern-
+// Standby suspend (the #1122/#1139 death-timestamp lesson — a suspend gap makes
+// a benign exit look like a huge "uptime"), and neither is crash-loop churn.
+// The slow-loop residual this fix targets dies well within the ceiling
+// (~65-90s), so it is unaffected. This is a belt-and-suspenders guard on top of
+// the structural defense that the window is per-KEY: a single suspend kills at
+// most one live client per server, contributing at most one death to any one
+// key's window, so it cannot by itself reach the trip count regardless.
+const RUNTIME_EXIT_WINDOW_UPTIME_CEILING_MS = 10 * 60_000;
 // #743: a server whose per-server notify write (didOpen/didChange) times out
 // this many times in a row is a persistently backpressured server; it is demoted
 // into the `broken` cooldown map (evicted + cooled down) so subsequent sweeps
@@ -81,6 +160,20 @@ const NAV_CLIENT_WAIT_TIMEOUT_MS = Math.max(0, Number.parseInt(process.env.PI_LE
     1500);
 const TOUCH_DEBOUNCE_MS = Math.max(0, Number.parseInt(process.env.PI_LENS_LSP_TOUCH_DEBOUNCE_MS ?? "1500", 10) ||
     1500);
+const DEFAULT_LSP_CLIENT_CEILING = 24;
+const DEFAULT_TS_IDLE_EVICT_MS = 20 * 60_000;
+export function getTypeScriptIdleEvictMs() {
+    const parsed = Number.parseInt(process.env.PI_LENS_TS_IDLE_EVICT_MS ?? "", 10);
+    return Number.isSafeInteger(parsed) && parsed > 0
+        ? parsed
+        : DEFAULT_TS_IDLE_EVICT_MS;
+}
+export function getLspClientCeiling() {
+    const parsed = Number.parseInt(process.env.PI_LENS_LSP_CLIENT_CEILING ?? "", 10);
+    return Number.isSafeInteger(parsed) && parsed > 0
+        ? parsed
+        : DEFAULT_LSP_CLIENT_CEILING;
+}
 // #667: the sweep warm-up round trip's OWN generous, one-time budget —
 // deliberately larger than any single per-file sweep budget (`perFileMs` in
 // `runWorkspaceDiagnostics`, or the batch tool's per-file wait) because this
@@ -137,13 +230,15 @@ function readTsserverSyncGraceMs() {
 }
 /**
  * Read the `PI_LENS_AUX_GRACE_MS` env override at call time (not module
- * load time) so tests can set it per-case. Controls how long auxiliary-role
- * promises (opengrep, ast-grep, zizmor, …) are waited after all primary-role
- * promises have settled in both getDiagnostics (raceToCompletion) and the
- * touchFile push wait. Default 500ms — conservative enough to include
- * auxiliaries that are nearly done while not blocking the primary result.
- * Returns undefined when the var is absent (caller falls back to the
- * raceToCompletion default of 500ms, keeping the two in sync).
+ * load time) so tests can set it per-case. Controls the CEILING on how long
+ * auxiliary-role promises (opengrep, ast-grep, zizmor, …) are waited after
+ * all primary-role promises have settled, in both getDiagnostics
+ * (raceToCompletion) and the touchFile push wait (#1458 S2 — the two lanes
+ * share the same declared-budget-capped-by-ceiling shape). Each auxiliary
+ * still gets only its OWN declared `aggregateWaitMs` up to this ceiling —
+ * this is not a flat per-touch wait. Returns undefined when the var is
+ * absent; each call site then supplies its own default ceiling (touchFile:
+ * 2000ms; getDiagnostics: 2000ms — see the `?? 2000` at each call site).
  */
 function readEnvAuxGraceMs() {
     const raw = process.env.PI_LENS_AUX_GRACE_MS;
@@ -279,7 +374,7 @@ const WORKSPACE_SWEEP_PREOPEN_CHUNK_SIZE = (() => {
     return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : 8;
 })();
 // #584: opengrep has no `workspace/diagnostic` pull support (push-only,
-// docs/servercapabilities.md) and `reopenOnResync: true` (server-strategies.ts)
+// docs/servercapabilities.md) and `reopenOnResync: true` (wait-policy/strategies.ts)
 // means every per-file LSP touch already forces a full re-scan anyway — there's
 // no incremental win from routing it through the sweep's per-file loop. On a
 // full workspace sweep it instead dominates the per-file wait (its own
@@ -390,11 +485,50 @@ async function collectWorkspaceDiagnosticFiles(root, maxFiles = getMaxWorkspaceD
 export class LSPService {
     state;
     workspaceProbeLogged = new Set();
+    /** Per-service immutable root-boundary verdicts; root detectors cache hits too. */
+    projectBoundaryCache = new Map();
     warmStartLogged = new Set();
     optionalFailureLogged = new Set();
+    /** Server/root pairs that already emitted unavailable for the current occurrence. */
+    unavailableLogged = new Set();
     optionalDisabled = new Set();
     /** Consecutive failure counts for exponential backoff circuit breaker */
     failureCounts = new Map();
+    /**
+     * #1127: consecutive EARLY post-init runtime exits — a client that closed
+     * unexpectedly (not via our own `shutdown()`) with an uptime under
+     * {@link RUNTIME_EXIT_UPTIME_THRESHOLD_MS}. Tracked separately from
+     * {@link failureCounts} because a successful spawn/initialize clears that
+     * map (correct for the spawn/init failure class it was built for — see
+     * `spawnClient`'s success path) but is exactly the event a crash-loop
+     * server keeps producing right before it dies again; reusing the same map
+     * would make every respawn erase the streak the moment it re-spawned,
+     * which is the #1127 bug. This counter shares the SAME cooldown formula,
+     * the SAME `state.broken`/`permanentlyBroken` maps, and the SAME
+     * give-up-after-N-failures threshold as the spawn/init breaker — it is a
+     * parallel counter feeding one circuit, not a second mechanism.
+     */
+    runtimeExitCounts = new Map();
+    /**
+     * #1142: rolling window of recent non-intentional death timestamps
+     * (`exitedAt`) per "serverId:root" key (the SAME identity as
+     * {@link runtimeExitCounts} and {@link LSPState.broken} — defect shape 1) —
+     * the SECOND, independent breaker trip condition that COMPOSES with the
+     * {@link runtimeExitCounts} fast path. That counter only sees CONSECUTIVE
+     * exits under the 60s threshold; a server that dies just PAST it every spawn
+     * resets that streak forever (#1142). This window trips when
+     * {@link RUNTIME_EXIT_WINDOW_TRIP_COUNT} deaths fall within
+     * {@link RUNTIME_EXIT_WINDOW_MS}, regardless of each death's lifetime.
+     *
+     * Bounded on BOTH axes (defect shape 9): entries older than the window are
+     * pruned on every record, AND the array is hard-capped at the trip count
+     * (drop-oldest) — a rate trip needs only the count within the window, never
+     * an unbounded history of timestamps. No timer backs it (defect shape 4): it
+     * ages purely by prune-on-check, so there is nothing to `unref()` or
+     * print-mode-gate. Like {@link runtimeExitCounts} it is a per-instance field,
+     * so a fresh `LSPService` (via `resetLSPService`) starts empty.
+     */
+    runtimeExitWindow = new Map();
     /** Server/root keys disabled for the rest of this session after repeated failures. */
     permanentlyBroken = new Set();
     /**
@@ -413,7 +547,26 @@ export class LSPService {
      * those falls through to a fresh check rather than serving a stale result.
      */
     lastKnownContentHash = new Map();
+    /**
+     * #1095: lazily verifies a stored {@link DiagnosticBinding} against current
+     * disk bytes, memoizing the disk fingerprint per (file, mtime) so repeated
+     * binding reads across `touchFile`/`getAllDiagnostics` within a session don't
+     * re-hash unchanged files. Owned by the service so the memo is shared.
+     */
+    diskBindingCache = createDiskBindingCache();
     lastDiagnosticsHealth = new Map();
+    /**
+     * Touch-debounce record of "this server already has this content", keyed
+     * "normalizedFilePath:clientScope:serverId".
+     *
+     * #743/#1253: the serverId component is load-bearing. #1253 requires that a
+     * server whose notify write never landed does NOT get an entry (otherwise the
+     * next touch debounces the re-push and the silent-clean gates read its silence
+     * as a confirmed clean). #743 requires that one wedged server must not degrade
+     * its healthy siblings. A file-level key can only satisfy one of those at a
+     * time — per-server, both hold: the stalled server simply has no entry and is
+     * re-pushed, while every sibling whose write landed keeps its own debounce.
+     */
     recentTouches = new Map();
     /**
      * #743: consecutive per-server notify-write timeout count, keyed by
@@ -424,6 +577,23 @@ export class LSPService {
      * successful write clears its entry.
      */
     notifyWriteBackpressureStreak = new Map();
+    /** LRU clock for capacity eviction, keyed by the canonical server/root key. */
+    clientLastUsedAt = new Map();
+    /**
+     * Manager-owned use leases close the acquisition/use gap that `isBusy()`
+     * cannot see: a caller may hold a selected client before its first request has
+     * entered the client. Eviction skips any key with an outstanding lease.
+     */
+    clientLeases = new Map();
+    /**
+     * Per-root idle eviction for TypeScript's large, rebuildable program graph.
+     * Timers are unref'd so an idle language service cannot keep a one-shot host
+     * alive, and are removed before shutdown so a concurrent request rebuilds
+     * instead of receiving the retiring client.
+     */
+    typeScriptIdleTimers = new Map();
+    /** Serializes capacity decisions with publication into `state.inFlight`. */
+    clientSpawnGate = Promise.resolve();
     /** True after shutdown() has been called; blocks new operations */
     isDestroyed = false;
     /**
@@ -446,10 +616,218 @@ export class LSPService {
             demonstratedCold: new Set(),
         };
     }
+    /**
+     * Resolve one server's client identity root. Root selection is hard-bounded
+     * by the session cwd, then config-only nested roots reuse an already-hosted
+     * same-server ancestor. Real nested projects retain independent clients.
+     */
+    async resolveServerRoot(server, filePath) {
+        const candidate = await server.root(filePath);
+        if (!candidate)
+            return undefined;
+        const root = enforceLspRootCeiling(candidate, process.cwd(), filePath);
+        if (normalizeMapKey(root) === normalizeMapKey(process.cwd()))
+            return root;
+        const rootKey = normalizeMapKey(root);
+        const prefix = `${server.id}:`;
+        let nearestAncestor;
+        for (const key of new Set([
+            ...this.state.clients.keys(),
+            ...this.state.inFlight.keys(),
+        ])) {
+            if (!key.startsWith(prefix))
+                continue;
+            const ancestorKey = key.slice(prefix.length);
+            const pathApi = isWindowsPath(ancestorKey) || isWindowsPath(rootKey)
+                ? path.win32
+                : path;
+            const relative = pathApi.relative(ancestorKey, rootKey);
+            if (relative === "" ||
+                relative.startsWith("..") ||
+                pathApi.isAbsolute(relative)) {
+                continue;
+            }
+            if (!nearestAncestor || ancestorKey.length > nearestAncestor.length) {
+                nearestAncestor = ancestorKey;
+            }
+        }
+        if (!nearestAncestor)
+            return root;
+        let boundary = this.projectBoundaryCache.get(rootKey);
+        if (!boundary) {
+            boundary = hasProjectBoundaryMarker(root);
+            this.projectBoundaryCache.set(rootKey, boundary);
+        }
+        if (await boundary)
+            return root;
+        return (this.state.clients.get(`${server.id}:${nearestAncestor}`)?.root ??
+            nearestAncestor);
+    }
     /** Guard: return true if service is shutting down or shut down */
     checkDestroyed() {
         return this.isDestroyed;
     }
+    async withClientSpawnGate(operation) {
+        const previous = this.clientSpawnGate;
+        let release;
+        this.clientSpawnGate = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+        }
+    }
+    async clientKeyFor(entry, filePath) {
+        const root = await this.resolveServerRoot(entry.info, filePath);
+        return root ? `${entry.info.id}:${normalizeMapKey(root)}` : undefined;
+    }
+    async acquireClientLease(entry, filePath) {
+        const key = await this.clientKeyFor(entry, filePath);
+        if (!key)
+            return undefined;
+        return this.withClientSpawnGate(async () => {
+            if (this.isDestroyed || this.state.clients.get(key) !== entry.client) {
+                return undefined;
+            }
+            this.clientLeases.set(key, (this.clientLeases.get(key) ?? 0) + 1);
+            return key;
+        });
+    }
+    async acquireClientLeases(entries, filePath) {
+        const keys = await Promise.all(entries.map((entry) => this.clientKeyFor(entry, filePath)));
+        if (keys.some((key) => key === undefined))
+            return undefined;
+        const keyed = entries.map((entry, index) => [keys[index], entry]);
+        return this.withClientSpawnGate(async () => {
+            if (this.isDestroyed ||
+                keyed.some(([key, entry]) => this.state.clients.get(key) !== entry.client)) {
+                return undefined;
+            }
+            for (const [key] of keyed) {
+                this.clientLeases.set(key, (this.clientLeases.get(key) ?? 0) + 1);
+            }
+            return keyed.map(([key]) => key);
+        });
+    }
+    releaseClientLease(key) {
+        const remaining = (this.clientLeases.get(key) ?? 1) - 1;
+        if (remaining > 0) {
+            this.clientLeases.set(key, remaining);
+            return;
+        }
+        this.clientLeases.delete(key);
+        if (this.state.clients.has(key)) {
+            this.clientLastUsedAt.set(key, Date.now());
+            this.scheduleTypeScriptIdleEviction(key);
+        }
+    }
+    async withClientForFileUse(filePath, maxWaitMs, hardCapMs, use) {
+        while (!this.isDestroyed) {
+            const entry = await this.getClientForFile(filePath, maxWaitMs, hardCapMs);
+            if (!entry)
+                return undefined;
+            const leaseKey = await this.acquireClientLease(entry, filePath);
+            if (!leaseKey)
+                continue;
+            try {
+                return await use(entry);
+            }
+            finally {
+                this.releaseClientLease(leaseKey);
+            }
+        }
+        return undefined;
+    }
+    async makeCapacityForClient(key) {
+        const occupiedKeys = new Set(this.state.inFlight.keys());
+        for (const [clientKey, client] of this.state.clients) {
+            if (client.isAlive())
+                occupiedKeys.add(clientKey);
+        }
+        const occupied = occupiedKeys.size;
+        if (occupied < getLspClientCeiling())
+            return true;
+        const idle = [...this.state.clients.entries()]
+            .filter(([candidateKey, client]) => candidateKey !== key &&
+            client.isAlive() &&
+            client.isBusy?.() !== true &&
+            (this.clientLeases.get(candidateKey) ?? 0) === 0)
+            .sort(([a], [b]) => (this.clientLastUsedAt.get(a) ?? this.state.clientSpawnedAt.get(a) ?? 0) -
+            (this.clientLastUsedAt.get(b) ?? this.state.clientSpawnedAt.get(b) ?? 0));
+        const victim = idle[0];
+        if (!victim) {
+            logSessionStart(`lsp client ceiling ${getLspClientCeiling()}: spawn declined; all clients are in use`);
+            return false;
+        }
+        const [victimKey, victimClient] = victim;
+        await victimClient.shutdown({ reason: "client_ceiling_lru" });
+        this.state.clients.delete(victimKey);
+        this.state.clientSpawnedAt.delete(victimKey);
+        this.state.demonstratedReady.delete(victimKey);
+        this.state.demonstratedCold.delete(victimKey);
+        this.clientLastUsedAt.delete(victimKey);
+        this.clearTypeScriptIdleTimer(victimKey);
+        logSessionStart(`lsp client ceiling ${getLspClientCeiling()}: evicted idle LRU ${victimKey}`);
+        return true;
+    }
+    clearTypeScriptIdleTimer(key) {
+        const timer = this.typeScriptIdleTimers.get(key);
+        if (timer)
+            clearTimeout(timer);
+        this.typeScriptIdleTimers.delete(key);
+    }
+    scheduleTypeScriptIdleEviction(key) {
+        if (!key.startsWith("typescript:"))
+            return;
+        // Pressure-gating these timers would require a separate reconciliation pass
+        // when the manager crosses the threshold; keep ownership simple and use the
+        // warm-LSP-friendly 20-minute default instead.
+        this.clearTypeScriptIdleTimer(key);
+        const lastUsedAt = this.clientLastUsedAt.get(key) ?? Date.now();
+        const timer = setTimeout(() => {
+            this.typeScriptIdleTimers.delete(key);
+            void this.withClientSpawnGate(async () => {
+                if (this.isDestroyed)
+                    return;
+                const client = this.state.clients.get(key);
+                if (!client?.isAlive())
+                    return;
+                if (client.isBusy?.() === true ||
+                    (this.clientLeases.get(key) ?? 0) > 0 ||
+                    (this.clientLastUsedAt.get(key) ?? 0) !== lastUsedAt) {
+                    this.scheduleTypeScriptIdleEviction(key);
+                    return;
+                }
+                // Publish the cold state synchronously before awaiting teardown. A request
+                // arriving while shutdown is in progress therefore waits on the spawn gate
+                // and creates a fresh client; it can never receive this retiring one.
+                this.state.clients.delete(key);
+                this.state.clientSpawnedAt.delete(key);
+                this.state.demonstratedReady.delete(key);
+                this.state.demonstratedCold.delete(key);
+                this.clientLastUsedAt.delete(key);
+                try {
+                    await client.shutdown({ reason: "typescript_idle_eviction" });
+                }
+                catch {
+                    // The strong manager reference is already gone; shutdown is best-effort
+                    // like the other eviction paths and must not reject from a timer callback.
+                }
+                logSessionStart(`lsp typescript idle eviction: released ${key}`);
+                recordDegradation({
+                    kind: "ts-idle-eviction",
+                    subject: key,
+                    reason: "idle TypeScript client released to bound memory",
+                });
+            }).catch(() => { });
+        }, getTypeScriptIdleEvictMs());
+        timer.unref?.();
+        this.typeScriptIdleTimers.set(key, timer);
+    }
     fingerprintContent(content) {
         if (content.length <= 96) {
             return `${content.length}:${content}`;
@@ -461,10 +839,15 @@ export class LSPService {
      * NOT need diagnostics — those callers still need to wait for the LSP to
      * publish, even if the notify itself is a no-op.
      */
-    shouldSkipTouch(filePath, content, clientScope, waitForDiagnostics) {
+    shouldSkipTouch(filePath, content, clientScope, waitForDiagnostics, serverIds) {
         if (waitForDiagnostics)
             return false;
-        return this.shouldSkipNotify(filePath, content, clientScope);
+        // #743: only short-circuit the whole call when EVERY spawned server already
+        // has this content. If even one still needs the push, fall through — the
+        // write loop skips the servers that are covered and pushes only the rest.
+        if (serverIds.length === 0)
+            return false;
+        return serverIds.every((serverId) => this.shouldSkipNotify(filePath, content, clientScope, serverId));
     }
     /**
      * Should the didOpen/didChange notify be skipped while keeping the
@@ -478,12 +861,14 @@ export class LSPService {
      * with diagnosticsMode="document" moments later. Without this check the
      * second call's notify clears in-progress diagnostics and the LSP has to
      * start over — observed as multi-second waits on slow TS projects.
+     *
+     * Decided PER SERVER (#743): a sibling's stalled write must not cost this
+     * server its debounce. See {@link recentTouches}.
      */
-    shouldSkipNotify(filePath, content, clientScope) {
+    shouldSkipNotify(filePath, content, clientScope, serverId) {
         if (TOUCH_DEBOUNCE_MS <= 0)
             return false;
-        const key = `${normalizeMapKey(filePath)}:${clientScope}`;
-        const previous = this.recentTouches.get(key);
+        const previous = this.recentTouches.get(this.recentTouchKey(filePath, clientScope, serverId));
         if (!previous)
             return false;
         const now = Date.now();
@@ -491,8 +876,11 @@ export class LSPService {
             return false;
         return previous.fingerprint === this.fingerprintContent(content);
     }
-    markTouched(filePath, content, clientScope) {
-        const key = `${normalizeMapKey(filePath)}:${clientScope}`;
+    recentTouchKey(filePath, clientScope, serverId) {
+        return `${normalizeMapKey(filePath)}:${clientScope}:${serverId}`;
+    }
+    markTouched(filePath, content, clientScope, serverId) {
+        const key = this.recentTouchKey(filePath, clientScope, serverId);
         const now = Date.now();
         this.recentTouches.set(key, {
             fingerprint: this.fingerprintContent(content),
@@ -501,8 +889,10 @@ export class LSPService {
         });
         // Trim entries that are already past the debounce window — shouldSkipTouch
         // ignores them anyway, so they serve no purpose. Only sweep when the map
-        // exceeds the threshold to avoid iterating on every call.
-        if (this.recentTouches.size > 200) {
+        // exceeds the threshold to avoid iterating on every call. The threshold is
+        // per-ENTRY and entries are now per-server, so it is scaled up to keep the
+        // same effective file capacity a file-level key gave a multi-server scope.
+        if (this.recentTouches.size > 800) {
             for (const [k, v] of this.recentTouches) {
                 if (now - v.touchedAt > TOUCH_DEBOUNCE_MS) {
                     this.recentTouches.delete(k);
@@ -522,7 +912,7 @@ export class LSPService {
      * implementation that doesn't independently stamp `.root`).
      */
     async demonstratedReadyKeyFor(server, filePath) {
-        const root = await server.root(filePath);
+        const root = await this.resolveServerRoot(server, filePath);
         if (!root)
             return undefined;
         return `${server.id}:${normalizeMapKey(root)}`;
@@ -534,6 +924,9 @@ export class LSPService {
         // the negative cache.
         this.state.demonstratedCold.delete(key);
     }
+    recordBreaker(key, reason) {
+        recordDegradationOnce({ kind: "lsp-breaker", subject: key, reason });
+    }
     /**
      * #743: record one notify-write timeout for a server and, once it has stalled
      * {@link NOTIFY_BACKPRESSURE_BROKEN_AFTER} times in a row, demote it through
@@ -558,6 +951,8 @@ export class LSPService {
         this.state.clients.delete(key);
         this.state.clientSpawnedAt.delete(key);
         this.state.demonstratedReady.delete(key);
+        this.clientLastUsedAt.delete(key);
+        this.clearTypeScriptIdleTimer(key);
         logLatency({
             type: "phase",
             phase: "lsp_notify_backpressure_broken",
@@ -633,14 +1028,25 @@ export class LSPService {
                     return spawned;
                 }
             }
+            const unavailable = (await Promise.all(servers.map(async (server) => {
+                const root = await server.root(filePath);
+                return {
+                    server,
+                    key: `${server.id}:${root ? normalizeMapKey(root) : "<unresolved>"}`,
+                };
+            }))).filter(({ key }) => !this.unavailableLogged.has(key));
+            for (const { key } of unavailable)
+                this.unavailableLogged.add(key);
+            if (unavailable.length === 0)
+                return undefined;
             logLatency({
                 type: "phase",
                 phase: "lsp_client_unavailable",
                 filePath,
                 durationMs: 0,
                 metadata: {
-                    candidateCount: servers.length,
-                    servers: servers.map((server) => server.id),
+                    candidateCount: unavailable.length,
+                    servers: unavailable.map(({ server }) => server.id),
                 },
             });
             return undefined;
@@ -649,10 +1055,31 @@ export class LSPService {
             return withBudget();
         }
         const timeoutSentinel = Symbol("lsp-client-wait-timeout");
-        const waitResult = await Promise.race([
-            withBudget(),
-            new Promise((resolve) => setTimeout(() => resolve(timeoutSentinel), effectiveMaxWaitMs)),
-        ]);
+        // #1097: store the timer and clear it once the race settles. Without this,
+        // when `withBudget()` wins (the common case: the client is ready well before
+        // the budget), the losing `setTimeout` stays a REF'D pending timer for the
+        // full remaining `effectiveMaxWaitMs`. In a long-lived interactive session
+        // that is invisible (it fires later, resolves an orphan promise, is GC'd).
+        // In a one-shot `pi --print --no-session` process it is fatal: the timer
+        // keeps the event loop alive for up to `effectiveMaxWaitMs` after
+        // `agent_settled`/`session_shutdown`, so the completed process never exits
+        // (issue #1097 — a recurrence of the #22 symptom via a different handle, and
+        // a member of the uncleared-race-timeout class the shared `withDeadline`
+        // helper already guards against elsewhere).
+        let waitTimer;
+        let waitResult;
+        try {
+            waitResult = await Promise.race([
+                withBudget(),
+                new Promise((resolve) => {
+                    waitTimer = setTimeout(() => resolve(timeoutSentinel), effectiveMaxWaitMs);
+                }),
+            ]);
+        }
+        finally {
+            if (waitTimer)
+                clearTimeout(waitTimer);
+        }
         if (waitResult === timeoutSentinel) {
             // Snapshot known client health — scan by serverId prefix (no root needed)
             const knownHealth = [...this.state.clients.entries()]
@@ -691,7 +1118,7 @@ export class LSPService {
             return { clients: [], serverCountAttempted: 0 };
         // Count servers with a valid root as "attempted" — extension-only matches
         // that fail the root check are not real spawn attempts.
-        const roots = await Promise.all(servers.map((s) => s.root(filePath)));
+        const roots = await Promise.all(servers.map((s) => this.resolveServerRoot(s, filePath)));
         const serverCountAttempted = roots.filter(Boolean).length;
         const spawned = await Promise.all(servers.map((server) => this.ensureClientForServer(filePath, server)));
         return {
@@ -722,7 +1149,7 @@ export class LSPService {
             return undefined;
         const servers = getServersForFileWithConfig(filePath);
         for (const server of servers) {
-            const root = await server.root(filePath);
+            const root = await this.resolveServerRoot(server, filePath);
             if (!root)
                 continue;
             const key = `${server.id}:${normalizeMapKey(root)}`;
@@ -744,7 +1171,7 @@ export class LSPService {
         for (const server of getServersForFileWithConfig(filePath)) {
             if (server.id !== serverId)
                 continue;
-            const root = await server.root(filePath);
+            const root = await this.resolveServerRoot(server, filePath);
             if (!root)
                 continue;
             const key = `${server.id}:${normalizeMapKey(root)}`;
@@ -763,10 +1190,10 @@ export class LSPService {
             if (this.checkDestroyed())
                 return undefined;
         }
-        const root = await server.root(filePath);
+        const root = await this.resolveServerRoot(server, filePath);
         if (!root || this.checkDestroyed())
             return undefined;
-        const allowInstall = this.shouldAllowInstall(filePath, root);
+        const allowInstall = this.shouldAllowInstall(server.id);
         const normalizedRoot = normalizeMapKey(root);
         const key = `${server.id}:${normalizedRoot}`;
         const isOptionalServer = OPTIONAL_LSP_SERVER_IDS.has(server.id); // NOSONAR: set intentionally empty — no optional servers configured yet
@@ -803,6 +1230,9 @@ export class LSPService {
         const existing = this.state.clients.get(key);
         if (existing) {
             if (existing.isAlive()) {
+                this.unavailableLogged.delete(key);
+                this.clientLastUsedAt.set(key, Date.now());
+                this.scheduleTypeScriptIdleEviction(key);
                 if (!this.warmStartLogged.has(key)) {
                     logSessionStart(`lsp warm-start ${server.id}: reused root=${root} file=${filePath}`);
                     this.warmStartLogged.add(key);
@@ -811,6 +1241,28 @@ export class LSPService {
             }
             // Dead client — was previously alive, now needs respawn
             const spawnedAt = this.state.clientSpawnedAt.get(key);
+            // #1127: capture BEFORE calling existing.shutdown() below — both
+            // wasShutdownIntentional() and getExitedAt() read state that
+            // existing.shutdown() itself mutates as a side effect of our own
+            // cleanup (shutdownRequested flips true, and the process exit it
+            // triggers would stamp exitedAt at CLEANUP time rather than at the
+            // real death), so both must be read before that call.
+            const wasIntentional = existing.wasShutdownIntentional();
+            const exitedAt = existing.getExitedAt();
+            // #1127: lifetime MUST be measured from the client's own recorded
+            // death (exitedAt), not from "now" (this detection). Detection is
+            // lazy — the next file attach — and #1127's real-world pattern is
+            // attach-triggered respawns minutes to HOURS apart: a server that
+            // died 5s after spawning but wasn't detected until an hour later
+            // must still read as an early, breaker-worthy exit. Fall back to the
+            // detection-time delta only when exitedAt is somehow unset (the
+            // client's own exit handlers always set it before isAlive() can go
+            // false, so this is a defensive fallback, not the expected path).
+            const uptimeMs = exitedAt != null && spawnedAt != null
+                ? exitedAt - spawnedAt
+                : spawnedAt != null
+                    ? Date.now() - spawnedAt
+                    : null;
             logLatency({
                 type: "phase",
                 phase: "lsp_server_respawn",
@@ -819,7 +1271,8 @@ export class LSPService {
                 metadata: {
                     serverId: server.id,
                     root,
-                    uptimeMs: spawnedAt != null ? Date.now() - spawnedAt : null,
+                    uptimeMs,
+                    intentional: wasIntentional,
                 },
             });
             try {
@@ -830,7 +1283,127 @@ export class LSPService {
             }
             this.state.clients.delete(key);
             this.state.clientSpawnedAt.delete(key);
+            this.clientLastUsedAt.delete(key);
+            this.clearTypeScriptIdleTimer(key);
             this.state.broken.delete(key);
+            // #1127: count EARLY, non-intentional runtime exits toward the circuit
+            // breaker. Spawn/initialize itself succeeded here (this client made it
+            // into state.clients), so `failureCounts` — the spawn/init breaker —
+            // never saw this failure and was cleared to 0 on that earlier success.
+            // Without this, a server that spawns fine and then dies shortly after
+            // serving (opengrep's post-init "Unhandled message" crash, #1122/#1127)
+            // respawns forever: cooldown/permanent-disable never engage.
+            //
+            // Deliberate teardowns (session reset, #743 notify-backpressure
+            // eviction, a generation handoff) call `shutdown()` themselves and set
+            // `shutdownRequested` before the process exits — those must never count,
+            // or a legitimate restart would wrongly march the server toward
+            // permanent disablement.
+            if (wasIntentional) {
+                // Not evidence of a bad server — leave any existing runtime-exit
+                // streak alone (a deliberate restart is not a recovery signal
+                // either; only clear the streak once the server proves itself by
+                // staying up past the threshold, handled in the `else` below). The
+                // windowed-rate trip below is likewise gated behind this
+                // `!wasIntentional` guard, so user-initiated restarts, config/
+                // workspace reloads, session changes, #743 eviction and generation
+                // handoffs (all shutdown()-driven) never feed it.
+            }
+            else {
+                // #1142: windowed-rate trip — the SECOND, independent breaker
+                // condition, composed with the fast path below. Record this
+                // non-intentional death and, if RUNTIME_EXIT_WINDOW_TRIP_COUNT
+                // deaths fell within the rolling window, give up NOW regardless of
+                // each death's individual lifetime. This catches the slow loop
+                // (dies just past the 60s threshold every spawn) that the
+                // consecutive-early-exit fast path structurally cannot see.
+                if (this.recordRuntimeExitWindow(key, exitedAt, uptimeMs)) {
+                    const rate = `${RUNTIME_EXIT_WINDOW_TRIP_COUNT} deaths within ${Math.round(RUNTIME_EXIT_WINDOW_MS / 60_000)}m`;
+                    // Set a cooldown so THIS detection also stops respawning (the
+                    // broken check below at the end of this method re-reads it),
+                    // symmetric with the fast path which cools down on every count.
+                    // `max` is defensive, not load-bearing under the actual call
+                    // order: `state.broken` for this key is `delete`d at the top of
+                    // this method (see the "detect dead client" branch above), so
+                    // this `.get(key) ?? 0` always reads 0 here — it's the fast
+                    // path below that runs AFTER this block and can raise the
+                    // cooldown for the same death. Harmless either way: the
+                    // non-optional branch latches `permanentlyBroken` (making the
+                    // cooldown moot), and the optional branch here is currently
+                    // unreachable (`OPTIONAL_LSP_SERVER_IDS` is empty).
+                    this.state.broken.set(key, Math.max(this.state.broken.get(key) ?? 0, Date.now() +
+                        (isOptionalServer
+                            ? OPTIONAL_LSP_RETRY_COOLDOWN_MS
+                            : BROKEN_MAX_COOLDOWN_MS)));
+                    if (isOptionalServer) {
+                        // Optional servers never latch permanently (mirrors the fast
+                        // path): cool down + disable for a retry interval, and reset
+                        // the window so the trip must be re-earned afterward.
+                        this.optionalDisabled.add(key);
+                        this.runtimeExitWindow.delete(key);
+                        logSessionStart(`lsp respawn ${server.id}: optional server cooled down (windowed-rate trip: ${rate})`);
+                    }
+                    else {
+                        this.permanentlyBroken.add(key);
+                        this.recordBreaker(key, `windowed runtime-exit trip: ${rate}`);
+                        logSessionStart(`lsp respawn ${server.id}: permanently disabled (windowed-rate trip: ${rate}, uptimeMs=${uptimeMs})`);
+                    }
+                }
+                // #1127/#1139 fast path — CONSECUTIVE exits UNDER the 60s
+                // threshold. UNCHANGED: its own counter, its own trip point. A
+                // single death may feed BOTH accumulators (the window above AND
+                // runtimeExitCounts here), but neither alters the other's threshold,
+                // so the fast path's trip point is exactly what it was.
+                if (uptimeMs != null &&
+                    uptimeMs < RUNTIME_EXIT_UPTIME_THRESHOLD_MS) {
+                    const rCount = (this.runtimeExitCounts.get(key) ?? 0) + 1;
+                    this.runtimeExitCounts.set(key, rCount);
+                    const rCooldown = Math.min(BROKEN_BASE_COOLDOWN_MS * 2 ** (rCount - 1), BROKEN_MAX_COOLDOWN_MS);
+                    this.state.broken.set(key, Date.now() + rCooldown);
+                    if (!isOptionalServer && rCount >= BROKEN_PERMANENT_AFTER) {
+                        this.permanentlyBroken.add(key);
+                        this.recordBreaker(key, `permanently disabled after ${rCount} early post-init exits`);
+                        logSessionStart(`lsp respawn ${server.id}: permanently disabled after ${rCount} early post-init exits (uptimeMs=${uptimeMs})`);
+                    }
+                    else {
+                        logSessionStart(`lsp respawn ${server.id}: early post-init exit ${rCount}/${BROKEN_PERMANENT_AFTER} (uptimeMs=${uptimeMs}), cooldown=${rCooldown}ms`);
+                    }
+                }
+                else {
+                    // Survived past the threshold (or uptime unknown) before dying —
+                    // this was a functioning server, not a HOT crash loop. Reset the
+                    // consecutive-early streak so an occasional post-longrun crash
+                    // doesn't creep it toward permanent disablement. The windowed
+                    // counter above is deliberately NOT reset here: a ~65-90s death
+                    // lands in this branch yet IS the churn #1142 targets — the
+                    // window ages those out by time instead.
+                    this.runtimeExitCounts.delete(key);
+                    // Outer-map hygiene (#1183): runtimeExitWindow itself is only
+                    // ever `delete`d on the optional-trip branch above (currently
+                    // unreachable — OPTIONAL_LSP_SERVER_IDS is empty), so a key
+                    // that crashed once then recovered would otherwise retain a
+                    // stale timestamp array forever, even once every entry in it
+                    // has aged out of the window. Drop it here once nothing in it
+                    // is still in-window — purely map hygiene: a later death
+                    // rebuilds the array from scratch via recordRuntimeExitWindow,
+                    // so this cannot change trip behavior. Anchor "now" on this
+                    // death's own `exitedAt` (falling back to real time only if
+                    // unset), NOT `Date.now()` directly — this death's timestamp
+                    // is what `recordRuntimeExitWindow` itself anchors pruning on
+                    // (see its `windowRef` comment), so a death that WAS just
+                    // recorded is guaranteed to still be in-window here and this
+                    // can only ever fire for the "declined to record" cases
+                    // (over the sleep-gap ceiling, or a missing `exitedAt`) where
+                    // nothing new was added and the array is genuinely stale.
+                    const windowDeaths = this.runtimeExitWindow.get(key);
+                    if (windowDeaths) {
+                        const windowNow = exitedAt ?? Date.now();
+                        if (!windowDeaths.some((t) => t >= windowNow - RUNTIME_EXIT_WINDOW_MS)) {
+                            this.runtimeExitWindow.delete(key);
+                        }
+                    }
+                }
+            }
         }
         const brokenUntil = this.state.broken.get(key);
         if (typeof brokenUntil === "number" && brokenUntil > Date.now()) {
@@ -851,31 +1424,53 @@ export class LSPService {
             if (isOptionalServer)
                 this.optionalDisabled.delete(key);
         }
-        const inFlight = this.state.inFlight.get(key);
-        if (inFlight) {
-            return inFlight;
+        let spawnPromise = this.state.inFlight.get(key);
+        if (!spawnPromise) {
+            const started = await this.withClientSpawnGate(async () => {
+                const raced = this.state.inFlight.get(key);
+                if (raced)
+                    return { promise: raced };
+                // `server.root()` and dead-client cleanup above are async. A reset during
+                // either gap must not let this retired generation start a late spawn.
+                if (this.checkDestroyed())
+                    return undefined;
+                if (!(await this.makeCapacityForClient(key)))
+                    return undefined;
+                const promise = this.spawnClient(server, root, key, filePath, allowInstall);
+                this.state.inFlight.set(key, promise);
+                return { promise };
+            });
+            if (!started)
+                return undefined;
+            spawnPromise = started.promise;
         }
-        // `server.root()` and a dead client's shutdown above are both async. A
-        // reset during either gap may have completed without seeing this request in
-        // state.inFlight; never let that retired generation start a late spawn.
-        if (this.checkDestroyed())
-            return undefined;
-        const spawnPromise = this.spawnClient(server, root, key, filePath, allowInstall);
-        this.state.inFlight.set(key, spawnPromise);
         try {
             return await spawnPromise;
         }
         finally {
-            this.state.inFlight.delete(key);
+            if (this.state.inFlight.get(key) === spawnPromise) {
+                this.state.inFlight.delete(key);
+            }
         }
     }
-    shouldAllowInstall(_filePath, _root) {
+    shouldAllowInstall(serverId) {
+        if (!assertInstallAllowed(`lsp install: ${serverId}`))
+            return false;
         return process.env.PI_LENS_DISABLE_LSP_INSTALL !== "1";
     }
     /**
      * Internal: spawn a client for a server/root combination
      */
     async spawnClient(server, root, key, filePath, allowInstall) {
+        // #1334 S5: honor the host project-trust decision before executing any
+        // project-resolved binary. Only an explicit host "not trusted" blocks —
+        // a host with no trust surface (`"unknown"`) spawns exactly as before.
+        // Deliberately NOT marked broken: trust is a policy outcome, not a server
+        // failure, and the user may grant trust later in the same session.
+        if (!isLspSpawnAllowedByTrust()) {
+            logSessionStart(`lsp spawn ${server.id}: refused — ${projectTrustDenialReason()}`);
+            return undefined;
+        }
         const isOptionalServer = OPTIONAL_LSP_SERVER_IDS.has(server.id); // NOSONAR: set intentionally empty — no optional servers configured yet
         const startedAt = Date.now();
         logSessionStart(`lsp spawn ${server.id}: start root=${root} install=${allowInstall ? "enabled" : "disabled"} file=${filePath}`);
@@ -914,6 +1509,7 @@ export class LSPService {
                 this.state.broken.set(key, Date.now() + uCooldown);
                 if (uCount >= BROKEN_PERMANENT_AFTER) {
                     this.permanentlyBroken.add(key);
+                    this.recordBreaker(key, `permanently disabled after ${uCount} unavailable spawns`);
                     logSessionStart(`lsp spawn ${server.id}: permanently disabled after ${uCount} failures`);
                 }
                 return undefined;
@@ -943,7 +1539,10 @@ export class LSPService {
                     diagnosticProviderKind: "unavailable",
                 };
             this.state.clients.set(key, client);
+            this.unavailableLogged.delete(key);
             this.state.clientSpawnedAt.set(key, Date.now());
+            this.clientLastUsedAt.set(key, Date.now());
+            this.scheduleTypeScriptIdleEviction(key);
             this.failureCounts.delete(key);
             if (isOptionalServer) {
                 this.optionalDisabled.delete(key);
@@ -973,6 +1572,7 @@ export class LSPService {
             this.state.broken.set(key, Date.now() + eCooldown);
             if (!isOptionalServer && eCount >= BROKEN_PERMANENT_AFTER) {
                 this.permanentlyBroken.add(key);
+                this.recordBreaker(key, `permanently disabled after ${eCount} spawn/initialize failures`);
                 logSessionStart(`lsp spawn ${server.id}: permanently disabled after ${eCount} failures`);
             }
             if (isOptionalServer) {
@@ -987,11 +1587,10 @@ export class LSPService {
     async openFile(filePath, content, options) {
         if (this.checkDestroyed())
             return;
-        const spawned = await this.getClientForFile(filePath, undefined, options?.spawnBudgetMs);
-        if (!spawned)
-            return;
-        const languageId = getLanguageId(filePath) ?? "plaintext";
-        await spawned.client.notify.open(filePath, content, languageId, options?.preserveDiagnostics);
+        await this.withClientForFileUse(filePath, undefined, options?.spawnBudgetMs, async (spawned) => {
+            const languageId = getLanguageId(filePath) ?? "plaintext";
+            await spawned.client.notify.open(filePath, content, languageId, options?.preserveDiagnostics);
+        });
     }
     /**
      * Update file content (sends textDocument/didChange)
@@ -999,10 +1598,7 @@ export class LSPService {
     async updateFile(filePath, content) {
         if (this.checkDestroyed())
             return;
-        const spawned = await this.getClientForFile(filePath);
-        if (!spawned)
-            return;
-        await spawned.client.notify.change(filePath, content);
+        await this.withClientForFileUse(filePath, undefined, undefined, (spawned) => spawned.client.notify.change(filePath, content));
     }
     /**
      * Touch a file like OpenCode's LSP flow: ensure document is open/synced,
@@ -1064,533 +1660,822 @@ export class LSPService {
             });
             return;
         }
-        if (this.shouldSkipTouch(filePath, content, clientScope, diagnosticsMode !== "none")) {
-            logLatency({
-                type: "phase",
-                phase: "lsp_touch_file",
-                filePath: normalizedPath,
-                durationMs: Date.now() - startedAt,
-                metadata: {
-                    serverCountReady: spawned.length,
-                    clientScope,
-                    diagnosticsMode,
-                    source,
-                    failureKind: "success",
-                    skipped: true,
-                    reason: "debounced_unchanged_content",
-                },
-            });
-            return [];
+        const leaseKeys = await this.acquireClientLeases(spawned, filePath);
+        if (!leaseKeys) {
+            // An idle eviction won between selection and lease admission. Resolve the
+            // now-current client set and replay; no notification targets the retiree.
+            return this.touchFile(filePath, content, options);
         }
-        const languageId = getLanguageId(filePath) ?? "plaintext";
-        const silent = options.silent ?? false;
-        // When the same content was already pushed to the LSP within the touch
-        // debounce window, skip the notify — pushing again clears the LSP's
-        // diagnostic cache (via notify.open) and forces it to restart work it
-        // already did. This is what makes the post-write touch + dispatch-lsp-
-        // runner touch sequence expensive on slow TS projects.
-        const notifySkipped = this.shouldSkipNotify(filePath, content, clientScope);
-        const diagnosticBaselines = new Map(spawned.map((entry) => [entry.client, entry.client.diagnosticsVersion]));
-        // #743: PER-SERVER notify-write deadlines. Each server's didOpen/didChange
-        // write gets its OWN notifyWriteBudgetMs budget rather than one shared
-        // deadline over a single Promise.all — otherwise one backpressured server
-        // (stalled stdin) times out the write for the ENTIRE file, flipping every
-        // co-touched healthy server to inconclusive and zeroing its diagnostics.
-        // Bounded so a backpressured write can't hang the caller; on timeout we
-        // proceed — the diagnostics wait below is separately bounded and simply
-        // returns no fresh diagnostics for the server(s) that stalled.
-        //
-        // Holds the serverId of every server whose write did NOT land in time.
-        // The file-level `notifyWriteTimedOut` (logged below) means "at least one
-        // server timed out"; this list carries the per-server detail the
-        // demonstratedReady gate reads so a healthy sibling stays eligible.
-        const notifyWriteTimedOutServerIds = [];
-        if (!notifySkipped) {
-            const budget = notifyWriteBudgetMs();
-            await Promise.all(spawned.map(async (entry) => {
-                // Same identity as the broken/demonstratedReady maps.
-                const clientKey = await this.demonstratedReadyKeyFor(entry.info, filePath);
-                let wrote;
-                let rejected = false;
-                try {
-                    wrote = await withDeadline(entry.client.notify
-                        .open(filePath, content, languageId, undefined, silent)
-                        .then(() => true), { ms: budget, onTimeout: "undefined", onReject: "propagate" });
-                }
-                catch {
-                    // The write itself rejected (not backpressure): the content did
-                    // not land, so this server is inconclusive for the touch, but a
-                    // rejection is not a stdin-backpressure signal and must not count
-                    // toward the backpressure demotion streak.
-                    rejected = true;
-                }
-                if (wrote === true) {
-                    // A clean write clears any accrued backpressure streak (#743).
-                    if (clientKey)
-                        this.notifyWriteBackpressureStreak.delete(clientKey);
-                }
-                else {
-                    notifyWriteTimedOutServerIds.push(entry.info.id);
-                    if (!rejected) {
-                        this.recordNotifyWriteBackpressure(clientKey, entry, filePath);
-                    }
-                }
-                return true;
-            }));
-            if (notifyWriteTimedOutServerIds.length > 0) {
+        try {
+            const spawnedServerIds = spawned.map((entry) => entry.info.id);
+            if (this.shouldSkipTouch(filePath, content, clientScope, diagnosticsMode !== "none", spawnedServerIds)) {
                 logLatency({
                     type: "phase",
-                    phase: "lsp_notify_timeout",
+                    phase: "lsp_touch_file",
                     filePath: normalizedPath,
                     durationMs: Date.now() - startedAt,
                     metadata: {
-                        source,
+                        serverCountReady: spawned.length,
                         clientScope,
-                        serverCount: spawned.length,
-                        timedOutServerIds: notifyWriteTimedOutServerIds,
+                        diagnosticsMode,
+                        source,
+                        failureKind: "success",
+                        skipped: true,
+                        reason: "debounced_unchanged_content",
                     },
                 });
+                // #1179: a debounced skip collected nothing — resolve the wrapper's
+                // `.diags` as empty with neither flag (exactly the pre-wrapper `[]`).
+                return { diags: [] };
             }
-        }
-        // File-level flag: at least one server's write timed out (kept for the
-        // conservative touch-wide `inconclusive` merge semantics — see below).
-        const notifyWriteTimedOut = notifyWriteTimedOutServerIds.length > 0;
-        let diagnosticsTimedOut = false;
-        // R8 (#714): server ids of aux-role servers whose push wait was cut off by
-        // the aux grace window. Undefined when no aux was cut off (primary-only
-        // paths never set this). Logged in lsp_touch_file metadata.
-        let auxCutOffServerIds;
-        // #707: tsserver sync clean-confirm state. `tsserverSyncEligible` is the
-        // full gate (evaluated once, before the wait); `tsserverSyncConfirmed`
-        // holds the sync commands' answer when the racing confirm won the wait
-        // (undefined = the race didn't produce an answer; the end-of-wait
-        // fallback below may still fill it in on a timed-out empty result).
-        let tsserverSyncEligible = false;
-        let tsserverSyncConfirmed;
-        if (diagnosticsMode !== "none") {
-            // Resolution: env wins so users can tune the cap without rebuilding.
-            // Otherwise, on the single-server hot path (primary scope), use that
-            // server's own strategy budget (server-strategies.ts) so a fast server
-            // (TypeScript ~1s) isn't held to a flat multi-second wait while a slow
-            // one (rust-analyzer 3s) gets the time it needs — bounded by any caller
-            // ceiling that exists to protect the per-edit pipeline budget (#203).
-            // #573: clientScope "all" (lsp_diagnostics, lens_diagnostics_full) now
-            // gets the same per-server treatment as "with-auxiliary" — each spawned
-            // server (primary + any auxiliaries) is bounded by ITS OWN strategy
-            // budget instead of one flat number shared by every server. This was
-            // never a deliberate "all means wait for the group ceiling" semantic:
-            // #203 introduced perServerTimeout only for the single-server primary
-            // path and left "full"/"all" on the pre-existing flat resolution
-            // ("full/cascade path unchanged"); #242 later added "with-auxiliary"
-            // without revisiting "all". The one property "all" genuinely needs —
-            // the touch's overall detection deadline is the SLOWEST spawned
-            // server's budget, not the fastest — is unaffected: `timeoutMs` below
-            // is always `Math.max(...spawned.map(timeoutFor))` regardless of which
-            // timeoutFor is selected, so a slow auxiliary still gets to run to its
-            // own budget before the touch is logged as timed out. What changes is
-            // only that a fast server's *individual* `waitForDiagnostics` call
-            // (further below) now resolves/times out against its own budget
-            // instead of blocking to the flat multi-server number.
-            const envWait = readEnvDiagnosticsWaitMs();
-            const callerCap = options.maxDiagnosticsWaitMs ?? options.maxClientWaitMs;
-            const modeFloor = diagnosticsMode === "full" ? 3000 : 1200;
-            // #645: resolve each spawned server's "is this the first same-sweep
-            // touch for it" verdict EXACTLY ONCE up front, before `perServerTimeout`
-            // is defined. `SweepIndexGate.consumeFirstTouch` is side-effecting
-            // (it marks the server seen), and `perServerTimeout` below is invoked
-            // twice per server in this call (once to compute the overall
-            // `timeoutMs` deadline, again inside the wait `Promise.all`) — calling
-            // the gate directly from inside `perServerTimeout` would consume the
-            // "first touch" slot on the first of those two calls and read as
-            // already-warm on the second, silently shortchanging the very touch
-            // that was supposed to get the full budget.
-            const sweepFirstTouch = new Map();
-            if (options.sweepIndexGate) {
-                for (const entry of spawned) {
-                    const strategy = getStrategy(entry.client.serverId);
-                    if (strategy.workspaceIndexing) {
-                        sweepFirstTouch.set(entry.client.serverId, options.sweepIndexGate.consumeFirstTouch(entry.client.serverId));
-                    }
-                }
-            }
-            // #832: workspace-indexing servers that are classified as silent on
-            // clean do not benefit from the generic cold-indexing floor. Their
-            // configured strategy already gives the first sweep touch a bounded
-            // workspace-index budget (marksman: 1500ms), while the capability
-            // classification proves that a clean push has no affirmative signal to
-            // wait for. Keep this restricted to the workspace-indexing strategy:
-            // TypeScript is also a silent-on-clean push server, but its cold project
-            // load still needs the longer 20s floor.
+            const languageId = getLanguageId(filePath) ?? "plaintext";
+            const silent = options.silent ?? false;
+            // When the same content was already pushed to the LSP within the touch
+            // debounce window, skip the notify — pushing again clears the LSP's
+            // diagnostic cache (via notify.open) and forces it to restart work it
+            // already did. This is what makes the post-write touch + dispatch-lsp-
+            // runner touch sequence expensive on slow TS projects.
             //
-            // Build this from the live spawned client's capabilities rather than
-            // server id alone. Missing/throwing capability data fails closed, so a
-            // new or ambiguous server keeps the existing generous warm-up budget.
-            const silentCleanWarmupServers = new Set();
-            if (options.warmupOverride && (options.warmupAttempt ?? 1) <= 1) {
-                for (const entry of spawned) {
-                    const strategy = getStrategy(entry.client.serverId);
-                    if (strategy.workspaceIndexing !== true)
-                        continue;
+            // #743: resolved PER SERVER. A server whose sibling's write stalled last
+            // touch still holds its own debounce entry, so it is skipped here while the
+            // stalled server (which has no entry) gets re-pushed. `notifySkipped` stays
+            // as the file-level "every server was skipped" summary for the logs and the
+            // no-new-version baseline below.
+            const notifySkippedServerIds = new Set(spawnedServerIds.filter((serverId) => this.shouldSkipNotify(filePath, content, clientScope, serverId)));
+            const notifySkipped = spawned.length > 0 && notifySkippedServerIds.size === spawned.length;
+            const diagnosticBaselines = new Map(spawned.map((entry) => [entry.client, entry.client.diagnosticsVersion]));
+            // #1458: read a late auxiliary publication BEFORE the ordinary resync
+            // clears its client cache. Carry it only when the publication's exact
+            // sent-content fingerprint matches this touch's content. A changed edit,
+            // version-less publication, or malformed binding fails closed and is not
+            // replayed. The fresh notify still runs below, so scanners continue toward
+            // a publication for this touch while the prior late result reaches the read.
+            const touchContentHash = this.hashContent(content);
+            const carriedAuxiliary = options.collectDiagnostics
+                ? spawned.flatMap((entry) => {
+                    if (entry.info.role !== "auxiliary")
+                        return [];
+                    const binding = entry.client.getDiagnosticBinding?.(filePath);
+                    if (binding?.contentHash !== touchContentHash)
+                        return [];
+                    const diags = entry.client.getDiagnostics(filePath);
+                    return diags.length > 0 ? [{ diags, binding }] : [];
+                })
+                : [];
+            // #743: PER-SERVER notify-write deadlines. Each server's didOpen/didChange
+            // write gets its OWN notifyWriteBudgetMs budget rather than one shared
+            // deadline over a single Promise.all — otherwise one backpressured server
+            // (stalled stdin) times out the write for the ENTIRE file, flipping every
+            // co-touched healthy server to inconclusive and zeroing its diagnostics.
+            // Bounded so a backpressured write can't hang the caller; on timeout we
+            // proceed — the diagnostics wait below is separately bounded and simply
+            // returns no fresh diagnostics for the server(s) that stalled.
+            //
+            // Holds the serverId of every server whose write did NOT land in time.
+            // The file-level `notifyWriteTimedOut` (logged below) means "at least one
+            // server timed out"; this list carries the per-server detail the
+            // demonstratedReady gate reads so a healthy sibling stays eligible.
+            const notifyWriteTimedOutServerIds = [];
+            if (!notifySkipped) {
+                const budget = notifyWriteBudgetMs();
+                await Promise.all(spawned.map(async (entry) => {
+                    // #743: this server already has this content from a recent touch
+                    // that landed. Pushing again would clear its diagnostic cache for
+                    // nothing — leave its debounce entry (and its original timestamp)
+                    // alone so the window still expires naturally.
+                    if (notifySkippedServerIds.has(entry.info.id))
+                        return;
+                    // Same identity as the broken/demonstratedReady maps.
+                    const clientKey = await this.demonstratedReadyKeyFor(entry.info, filePath);
+                    let wrote;
+                    let rejected = false;
                     try {
-                        const snapshot = {
-                            serverId: entry.client.serverId,
-                            root: entry.client.root,
-                            operationSupport: entry.client.getOperationSupport(),
-                            workspaceDiagnosticsSupport: entry.client.getWorkspaceDiagnosticsSupport(),
-                            advertisedCommands: entry.client.getAdvertisedCommands(),
-                            rawCapabilityKeys: entry.client.getRawCapabilityKeys?.() ?? [],
-                            launchVariant: entry.client.getLaunchVariant?.(),
-                        };
-                        if (classifyServerWaitTier(entry.client.serverId, snapshot) ===
-                            "tier3-silent") {
-                            silentCleanWarmupServers.add(entry.client.serverId);
-                        }
+                        wrote = await withDeadline(entry.client.notify
+                            .open(filePath, content, languageId, undefined, silent)
+                            .then(() => true), { ms: budget, onTimeout: "undefined", onReject: "propagate" });
                     }
                     catch {
-                        // Fail closed: capability uncertainty must retain the cold floor.
+                        // The write itself rejected (not backpressure): the content did
+                        // not land, so this server is inconclusive for the touch, but a
+                        // rejection is not a stdin-backpressure signal and must not count
+                        // toward the backpressure demotion streak.
+                        rejected = true;
                     }
+                    if (wrote === true) {
+                        // A clean write clears any accrued backpressure streak (#743).
+                        if (clientKey)
+                            this.notifyWriteBackpressureStreak.delete(clientKey);
+                        // #1253: record the debounce entry for THIS server only, and only
+                        // because its own write landed. A server whose write timed out or
+                        // rejected falls through without an entry, so the next touch
+                        // re-pushes it instead of laundering the failure into a later
+                        // touch that looks fully delivered (which the silent-clean gates
+                        // would then read as a confirmed clean).
+                        this.markTouched(filePath, content, clientScope, entry.info.id);
+                    }
+                    else {
+                        notifyWriteTimedOutServerIds.push(entry.info.id);
+                        if (!rejected) {
+                            this.recordNotifyWriteBackpressure(clientKey, entry, filePath);
+                        }
+                    }
+                }));
+                if (notifyWriteTimedOutServerIds.length > 0) {
+                    logLatency({
+                        type: "phase",
+                        phase: "lsp_notify_timeout",
+                        filePath: normalizedPath,
+                        durationMs: Date.now() - startedAt,
+                        metadata: {
+                            source,
+                            clientScope,
+                            serverCount: spawned.length,
+                            timedOutServerIds: notifyWriteTimedOutServerIds,
+                        },
+                    });
                 }
             }
-            // Each server gets its OWN deadline, bounded by the caller cap as a
-            // CEILING (never a floor) — so a clean push-silent primary (typescript
-            // ~1s) can't hold the whole touch to a slow auxiliary's budget, and a
-            // slow aux (opengrep) can't override the per-edit cap. Resolves as soon
-            // as a server publishes; this is just its individual deadline. (#242)
-            const perServerTimeout = (serverId) => {
-                const strategy = getStrategy(serverId);
-                let strategyWait = strategy.aggregateWaitMs;
-                // #645: a `workspaceIndexing` server (marksman) only needs the
-                // full budget for the FIRST same-sweep touch to it — every
-                // subsequent touch in this sweep uses the much shorter warm-wait
-                // instead, since the one-time index build only needs to finish
-                // once. `sweepFirstTouch` only has entries when a sweep gate was
-                // passed in AND the strategy is marked, so a per-edit touch
-                // (no gate) or an unmarked server is completely unaffected.
-                const isFirstTouch = sweepFirstTouch.get(serverId);
-                if (isFirstTouch === false && strategy.workspaceIndexing) {
-                    strategyWait =
-                        strategy.workspaceIndexingWarmWaitMs ??
-                            Math.min(300, strategyWait);
+            // File-level flag: at least one server's write timed out (kept for the
+            // conservative touch-wide `inconclusive` merge semantics — see below).
+            const notifyWriteTimedOut = notifyWriteTimedOutServerIds.length > 0;
+            let diagnosticsTimedOut = false;
+            // R8 (#714): server ids of aux-role servers whose push wait was cut off by
+            // the aux grace window. Undefined when no aux was cut off (primary-only
+            // paths never set this). Logged in lsp_touch_file metadata.
+            let auxCutOffServerIds;
+            // #707: tsserver sync clean-confirm state. `tsserverSyncEligible` is the
+            // full gate (evaluated once, before the wait); `tsserverSyncConfirmed`
+            // holds the sync commands' answer when the racing confirm won the wait
+            // (undefined = the race didn't produce an answer; the end-of-wait
+            // fallback below may still fill it in on a timed-out empty result).
+            let tsserverSyncEligible = false;
+            let tsserverSyncConfirmed;
+            if (diagnosticsMode !== "none") {
+                // Resolution: env wins so users can tune the cap without rebuilding.
+                // Otherwise, on the single-server hot path (primary scope), use that
+                // server's own strategy budget (wait-policy/strategies.ts) so a fast server
+                // (TypeScript ~1s) isn't held to a flat multi-second wait while a slow
+                // one (rust-analyzer 3s) gets the time it needs — bounded by any caller
+                // ceiling that exists to protect the per-edit pipeline budget (#203).
+                // #573: clientScope "all" (lsp_diagnostics, lens_diagnostics_full) now
+                // gets the same per-server treatment as "with-auxiliary" — each spawned
+                // server (primary + any auxiliaries) is bounded by ITS OWN strategy
+                // budget instead of one flat number shared by every server. This was
+                // never a deliberate "all means wait for the group ceiling" semantic:
+                // #203 introduced perServerTimeout only for the single-server primary
+                // path and left "full"/"all" on the pre-existing flat resolution
+                // ("full/cascade path unchanged"); #242 later added "with-auxiliary"
+                // without revisiting "all". The one property "all" genuinely needs —
+                // the touch's overall detection deadline is the SLOWEST spawned
+                // server's budget, not the fastest — is unaffected: `timeoutMs` below
+                // is always `Math.max(...spawned.map(timeoutFor))` regardless of which
+                // timeoutFor is selected, so a slow auxiliary still gets to run to its
+                // own budget before the touch is logged as timed out. What changes is
+                // only that a fast server's *individual* `waitForDiagnostics` call
+                // (further below) now resolves/times out against its own budget
+                // instead of blocking to the flat multi-server number.
+                const envWait = readEnvDiagnosticsWaitMs();
+                const callerCap = options.maxDiagnosticsWaitMs ?? options.maxClientWaitMs;
+                const modeFloor = diagnosticsMode === "full" ? 3000 : 1200;
+                // #645: resolve each spawned server's "is this the first same-sweep
+                // touch for it" verdict EXACTLY ONCE up front, before `perServerTimeout`
+                // is defined. `SweepIndexGate.consumeFirstTouch` is side-effecting
+                // (it marks the server seen), and `perServerTimeout` below is invoked
+                // twice per server in this call (once to compute the overall
+                // `timeoutMs` deadline, again inside the wait `Promise.all`) — calling
+                // the gate directly from inside `perServerTimeout` would consume the
+                // "first touch" slot on the first of those two calls and read as
+                // already-warm on the second, silently shortchanging the very touch
+                // that was supposed to get the full budget.
+                const sweepFirstTouch = new Map();
+                if (options.sweepIndexGate) {
+                    for (const entry of spawned) {
+                        const strategy = getStrategy(entry.client.serverId, entry.client.getLaunchVariant?.());
+                        if (strategy.workspaceIndexing) {
+                            sweepFirstTouch.set(entry.client.serverId, options.sweepIndexGate.consumeFirstTouch(entry.client.serverId));
+                        }
+                    }
                 }
-                if (callerCap !== undefined) {
-                    // #669: `ensureWarmForSweep`'s cold-server warm-up wants its cap
-                    // to act as a FLOOR (give it at least this much, possibly more
-                    // if the strategy already wants more) rather than the normal
-                    // ceiling — see `warmupOverride` doc on `LSPTouchFileOptions`.
-                    if (options.warmupOverride) {
-                        // #832: a workspace-indexing server already classified as
-                        // silent-on-clean uses its strategy's bounded wait on the first
-                        // attempt; the generic cold floor is for servers whose cold work
-                        // can eventually produce a push answer (notably TypeScript).
-                        if (silentCleanWarmupServers.has(serverId)) {
-                            return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
+                // #832: workspace-indexing servers that are classified as silent on
+                // clean do not benefit from the generic cold-indexing floor. Their
+                // configured strategy already gives the first sweep touch a bounded
+                // workspace-index budget (marksman: 1500ms), while the capability
+                // classification proves that a clean push has no affirmative signal to
+                // wait for. Keep this restricted to the workspace-indexing strategy:
+                // TypeScript is also a silent-on-clean push server, but its cold project
+                // load still needs the longer 20s floor.
+                //
+                // Build this from the live spawned client's capabilities rather than
+                // server id alone. Missing/throwing capability data fails closed, so a
+                // new or ambiguous server keeps the existing generous warm-up budget.
+                const silentCleanWarmupServers = new Set();
+                if (options.warmupOverride && (options.warmupAttempt ?? 1) <= 1) {
+                    for (const entry of spawned) {
+                        const strategy = getStrategy(entry.client.serverId, entry.client.getLaunchVariant?.());
+                        if (strategy.workspaceIndexing !== true)
+                            continue;
+                        try {
+                            const snapshot = {
+                                serverId: entry.client.serverId,
+                                root: entry.client.root,
+                                operationSupport: entry.client.getOperationSupport(),
+                                workspaceDiagnosticsSupport: entry.client.getWorkspaceDiagnosticsSupport(),
+                                advertisedCommands: entry.client.getAdvertisedCommands(),
+                                rawCapabilityKeys: entry.client.getRawCapabilityKeys?.() ?? [],
+                                launchVariant: entry.client.getLaunchVariant?.(),
+                            };
+                            if (classifyServerWaitTier(entry.client.serverId, snapshot) ===
+                                "tier3-silent") {
+                                silentCleanWarmupServers.add(entry.client.serverId);
+                            }
                         }
-                        // #799: only the FIRST warm-up attempt for a cold server gets the
-                        // floor — see the `warmupAttempt` doc on `LSPTouchFileOptions`.
-                        if ((options.warmupAttempt ?? 1) > 1) {
-                            return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
+                        catch {
+                            // Fail closed: capability uncertainty must retain the cold floor.
                         }
-                        return Math.max(callerCap, strategyWait > 0 ? strategyWait : 0);
                     }
-                    return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
                 }
-                return strategyWait > 0 ? strategyWait : modeFloor;
-            };
-            let timeoutFor;
-            if (envWait !== undefined) {
-                // Env override is a single flat cap so users can tune without rebuilding.
-                timeoutFor = () => envWait;
-            }
-            else if ((!useAllClients && spawned.length === 1) ||
-                clientScope === "with-auxiliary" ||
-                clientScope === "all") {
-                timeoutFor = perServerTimeout;
-            }
-            else {
-                // Fail-safe for any future clientScope this branch hasn't been
-                // taught about yet — keep the old flat resolution rather than
-                // silently mis-budgeting an unrecognized scope.
-                timeoutFor = () => callerCap ?? modeFloor;
-            }
-            // Detection deadline = the slowest individual server's budget.
-            const timeoutMs = Math.max(0, ...spawned.map((e) => timeoutFor(e.client.serverId)));
-            // #707: evaluate the tsserver sync clean-confirm gate BEFORE the wait
-            // starts. Cheap synchronous gates first (notify succeeded, collecting,
-            // primary scope, `serverId === "typescript"` — the sync commands this
-            // races are tsserver-specific protocol extensions, not a generic
-            // push-only capability, so #799 giving other servers (marksman) the
-            // SAME `silentOnClean` marker must not route them into a sync attempt
-            // that can never succeed for them), then the live capability-snapshot
-            // tier classification (`classifyCascadeWaitTier`, which also excludes
-            // native-ts7 via `launchVariant`). Every other server fails this
-            // synchronous gate and pays ZERO extra work — not even the snapshot
-            // read; a non-typescript `silentOnClean` server instead gets the
-            // generic (non-racing) clean-confirm fallback further below.
-            if (!notifyWriteTimedOut &&
-                options.collectDiagnostics === true &&
-                clientScope === "primary" &&
-                spawned.length === 1 &&
-                spawned[0].client.serverId === "typescript" &&
-                getStrategy(spawned[0].client.serverId).silentOnClean === true) {
-                try {
-                    const snapshots = await this.getCapabilitySnapshots(filePath);
-                    tsserverSyncEligible =
-                        classifyCascadeWaitTier(this, filePath, snapshots) ===
-                            "tier3-silent";
+                // Each server gets its OWN deadline, bounded by the caller cap as a
+                // CEILING (never a floor) — so a clean push-silent primary (typescript
+                // ~1s) can't hold the whole touch to a slow auxiliary's budget, and a
+                // slow aux (opengrep) can't override the per-edit cap. Resolves as soon
+                // as a server publishes; this is just its individual deadline. (#242)
+                const perServerTimeout = (serverId) => {
+                    const launchVariant = spawned.find((entry) => entry.client.serverId === serverId)?.client.getLaunchVariant?.();
+                    const strategy = getStrategy(serverId, launchVariant);
+                    let strategyWait = strategy.aggregateWaitMs;
+                    // #645: a `workspaceIndexing` server (marksman) only needs the
+                    // full budget for the FIRST same-sweep touch to it — every
+                    // subsequent touch in this sweep uses the much shorter warm-wait
+                    // instead, since the one-time index build only needs to finish
+                    // once. `sweepFirstTouch` only has entries when a sweep gate was
+                    // passed in AND the strategy is marked, so a per-edit touch
+                    // (no gate) or an unmarked server is completely unaffected.
+                    const isFirstTouch = sweepFirstTouch.get(serverId);
+                    if (isFirstTouch === false && strategy.workspaceIndexing) {
+                        strategyWait =
+                            strategy.workspaceIndexingWarmWaitMs ??
+                                Math.min(300, strategyWait);
+                    }
+                    if (callerCap !== undefined) {
+                        // #669: `ensureWarmForSweep`'s cold-server warm-up wants its cap
+                        // to act as a FLOOR (give it at least this much, possibly more
+                        // if the strategy already wants more) rather than the normal
+                        // ceiling — see `warmupOverride` doc on `LSPTouchFileOptions`.
+                        if (options.warmupOverride) {
+                            // #832: a workspace-indexing server already classified as
+                            // silent-on-clean uses its strategy's bounded wait on the first
+                            // attempt; the generic cold floor is for servers whose cold work
+                            // can eventually produce a push answer (notably TypeScript).
+                            if (silentCleanWarmupServers.has(serverId)) {
+                                return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
+                            }
+                            // #799: only the FIRST warm-up attempt for a cold server gets the
+                            // floor — see the `warmupAttempt` doc on `LSPTouchFileOptions`.
+                            if ((options.warmupAttempt ?? 1) > 1) {
+                                return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
+                            }
+                            return Math.max(callerCap, strategyWait > 0 ? strategyWait : 0);
+                        }
+                        return Math.min(callerCap, strategyWait > 0 ? strategyWait : callerCap);
+                    }
+                    return strategyWait > 0 ? strategyWait : modeFloor;
+                };
+                let timeoutFor;
+                if (envWait !== undefined) {
+                    // Env override is a single flat cap so users can tune without rebuilding.
+                    timeoutFor = () => envWait;
                 }
-                catch {
-                    // Fail-safe: ineligible — today's full wait, no sync attempt.
+                else if ((!useAllClients && spawned.length === 1) ||
+                    clientScope === "with-auxiliary" ||
+                    clientScope === "all") {
+                    timeoutFor = perServerTimeout;
                 }
-            }
-            const waitStartedAt = Date.now();
-            // R8 (#714): on the with-auxiliary path, apply a bounded aux grace so a
-            // slow auxiliary no longer holds the push wait to its own deadline.
-            // Primary waits resolve on their own per-server budget; once ALL primaries
-            // have settled the auxiliaries get at most auxGraceMs before we proceed.
-            // Primary-only and "all"/"primary" scopes are completely unaffected —
-            // they fall through to the original Promise.all path below.
-            //
-            // "Primary" here = a server whose LSPServerInfo.role is not "auxiliary".
-            // In the with-auxiliary spawn list, `getClientForFile` returns the
-            // language-primary entry first and `getAuxiliaryClientsForFile` appends
-            // the rest — but we use info.role rather than position so the logic is
-            // correct even if ordering shifts in the future.
-            //
-            // The #707 tsserver sync race operates exclusively on single-server
-            // primary-scope touches (guarded by `clientScope === "primary" &&
-            // spawned.length === 1`), so there is NO interaction with this path.
-            const hasTouchAuxiliaries = clientScope === "with-auxiliary" &&
-                spawned.some((e) => e.info.role === "auxiliary");
-            // Per-server wait promises (each already bounded by its own
-            // perServerTimeout — unchanged from before R8).
-            let pressureSnapshots = [];
-            if (shouldPreferPullOnlyDiagnostics()) {
-                try {
-                    pressureSnapshots = await this.getCapabilitySnapshots(filePath);
+                else {
+                    // Fail-safe for any future clientScope this branch hasn't been
+                    // taught about yet — keep the old flat resolution rather than
+                    // silently mis-budgeting an unrecognized scope.
+                    timeoutFor = () => callerCap ?? modeFloor;
                 }
-                catch {
-                    // Fail-open: missing capability state keeps today's push fallback.
+                // Detection deadline = the slowest individual server's budget.
+                const timeoutMs = Math.max(0, ...spawned.map((e) => timeoutFor(e.client.serverId)));
+                // #707: evaluate the tsserver sync clean-confirm gate BEFORE the wait
+                // starts. Cheap synchronous gates first (notify succeeded, collecting,
+                // primary scope, `serverId === "typescript"` — the sync commands this
+                // races are tsserver-specific protocol extensions, not a generic
+                // push-only capability, so #799 giving other servers (marksman) the
+                // SAME `silentOnClean` marker must not route them into a sync attempt
+                // that can never succeed for them), then the live capability-snapshot
+                // tier classification (`classifyCascadeWaitTier`, which also excludes
+                // native-ts7 via `launchVariant`). Every other server fails this
+                // synchronous gate and pays ZERO extra work — not even the snapshot
+                // read; a non-typescript `silentOnClean` server instead gets the
+                // generic (non-racing) clean-confirm fallback further below.
+                if (!notifyWriteTimedOut &&
+                    options.collectDiagnostics === true &&
+                    clientScope === "primary" &&
+                    spawned.length === 1 &&
+                    spawned[0].client.serverId === "typescript" &&
+                    getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
+                    try {
+                        const snapshots = await this.getCapabilitySnapshots(filePath);
+                        tsserverSyncEligible =
+                            classifyCascadeWaitTier(this, filePath, snapshots) ===
+                                "tier3-silent";
+                    }
+                    catch {
+                        // Fail-safe: ineligible — today's full wait, no sync attempt.
+                    }
                 }
-            }
-            const perServerWaits = spawned.map((entry) => {
-                const serverTimeout = timeoutFor(entry.client.serverId);
-                const baseline = diagnosticBaselines.get(entry.client);
-                const pullOnly = classifyServerWaitTier(entry.client.serverId, pressureSnapshots.find((snapshot) => snapshot.serverId === entry.client.serverId)) === "pull-capable";
-                const wait = !notifySkipped && Number.isFinite(baseline)
-                    ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
-                        minVersion: baseline,
-                        ...(pullOnly && { pullOnly: true }),
-                    })
-                    : pullOnly
+                const waitStartedAt = Date.now();
+                // R8 (#714): on the with-auxiliary path, apply a bounded aux grace so a
+                // slow auxiliary no longer holds the push wait to its own deadline.
+                // Primary waits resolve on their own per-server budget; once ALL primaries
+                // have settled the auxiliaries get at most auxGraceMs before we proceed.
+                // Primary-only and "all"/"primary" scopes are completely unaffected —
+                // they fall through to the original Promise.all path below.
+                //
+                // "Primary" here = a server whose LSPServerInfo.role is not "auxiliary".
+                // In the with-auxiliary spawn list, `getClientForFile` returns the
+                // language-primary entry first and `getAuxiliaryClientsForFile` appends
+                // the rest — but we use info.role rather than position so the logic is
+                // correct even if ordering shifts in the future.
+                //
+                // The #707 tsserver sync race operates exclusively on single-server
+                // primary-scope touches (guarded by `clientScope === "primary" &&
+                // spawned.length === 1`), so there is NO interaction with this path.
+                // #1458 S4: also gated on `collectDiagnostics` — a non-collecting
+                // with-auxiliary touch has nothing to carry the aux wait's result
+                // INTO (its diagnostics are discarded either way), so paying up to
+                // `auxCeilingMs` of extra latency for it buys nothing. Both current
+                // callers (`getDiagnostics`'s with-auxiliary path and the cascade's
+                // collecting touch) already pass `collectDiagnostics: true`, so this
+                // is latent-today defense, not a behavior change — but a future
+                // non-collecting with-auxiliary caller must not silently inherit the
+                // full aux-grace cost for diagnostics it's about to throw away.
+                const hasTouchAuxiliaries = clientScope === "with-auxiliary" &&
+                    options.collectDiagnostics === true &&
+                    spawned.some((e) => e.info.role === "auxiliary");
+                // Per-server wait promises (each already bounded by its own
+                // perServerTimeout — unchanged from before R8).
+                let pressureSnapshots = [];
+                if (shouldPreferPullOnlyDiagnostics()) {
+                    try {
+                        pressureSnapshots = await this.getCapabilitySnapshots(filePath);
+                    }
+                    catch {
+                        // Fail-open: missing capability state keeps today's push fallback.
+                    }
+                }
+                const perServerWaits = spawned.map((entry) => {
+                    const serverTimeout = timeoutFor(entry.client.serverId);
+                    const baseline = diagnosticBaselines.get(entry.client);
+                    const pullOnly = classifyServerWaitTier(entry.client.serverId, pressureSnapshots.find((snapshot) => snapshot.serverId === entry.client.serverId)) === "pull-capable";
+                    // #743: per-server — a server we DID push to still gets the
+                    // version-baseline wait even when a sibling was debounced away.
+                    const wait = !notifySkippedServerIds.has(entry.info.id) && Number.isFinite(baseline)
                         ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
-                            pullOnly: true,
+                            minVersion: baseline,
+                            ...(pullOnly && { pullOnly: true }),
                         })
-                        : entry.client.waitForDiagnostics(filePath, serverTimeout);
-                return wait.catch(() => undefined);
-            });
-            // The push wait — same per-server budget composition as before #707;
-            // only the awaiting changed (assigned so it can be raced below).
-            let pushWaitSettled = false;
-            const pushWait = hasTouchAuxiliaries
-                ? (() => {
-                    // Primary waits: all non-auxiliary servers.
-                    const primaryWaits = perServerWaits.filter((_, i) => spawned[i].info.role !== "auxiliary");
-                    // Aux waits: auxiliary servers (advisory).
-                    const auxWaits = perServerWaits
-                        .map((p, i) => spawned[i].info.role === "auxiliary"
-                        ? { promise: p, serverId: spawned[i].info.id }
-                        : null)
-                        .filter((x) => x !== null);
-                    const auxGraceMs = readEnvAuxGraceMs() ?? 500;
-                    // After all primaries settle, give auxiliaries at most auxGraceMs.
-                    // Late aux results are dropped from the wait (advisory only — they
-                    // land in the client cache and surface on the next edit); aux servers
-                    // that did answer within the grace are included automatically since
-                    // their waitForDiagnostics already resolved. The cut-off server ids
-                    // are logged in the latency metadata (lsp_touch_file phase, field
-                    // `auxCutOffServerIds`).
-                    return Promise.all(primaryWaits).then(async () => {
-                        if (auxWaits.length === 0)
-                            return;
-                        const auxTimeout = new Promise((resolve) => {
-                            const t = setTimeout(() => resolve("timeout"), auxGraceMs);
-                            if (typeof t === "object" && "unref" in t)
-                                t.unref?.();
-                        });
-                        const auxAll = Promise.all(auxWaits.map((a) => a.promise)).then(() => "done");
-                        const outcome = await Promise.race([auxAll, auxTimeout]);
-                        if (outcome === "timeout") {
-                            // Record which auxiliaries did NOT finish in time.
-                            const unfinished = [];
-                            for (const a of auxWaits) {
-                                let done = false;
-                                // Check synchronously if already resolved by racing against
-                                // a resolved promise.
-                                await Promise.race([
-                                    a.promise.then(() => {
-                                        done = true;
-                                    }),
-                                    Promise.resolve(),
-                                ]);
-                                if (!done)
-                                    unfinished.push(a.serverId);
+                        : pullOnly
+                            ? entry.client.waitForDiagnostics(filePath, serverTimeout, {
+                                pullOnly: true,
+                            })
+                            : entry.client.waitForDiagnostics(filePath, serverTimeout);
+                    return wait.catch(() => undefined);
+                });
+                // The push wait — same per-server budget composition as before #707;
+                // only the awaiting changed (assigned so it can be raced below).
+                let pushWaitSettled = false;
+                const pushWait = hasTouchAuxiliaries
+                    ? (() => {
+                        // Primary waits: all non-auxiliary servers.
+                        const primaryWaits = perServerWaits.filter((_, i) => spawned[i].info.role !== "auxiliary");
+                        // Aux waits: auxiliary servers (advisory). `client` and the
+                        // pre-notify `diagnosticsVersion` baseline travel alongside the
+                        // promise so the outcome can be decided from EVIDENCE after the
+                        // race, not from how the raced promise settled (#1458 S1 — see
+                        // below).
+                        const auxWaits = perServerWaits
+                            .map((p, i) => spawned[i].info.role === "auxiliary"
+                            ? {
+                                promise: p,
+                                serverId: spawned[i].info.id,
+                                client: spawned[i].client,
+                                baseline: diagnosticBaselines.get(spawned[i].client),
                             }
+                            : null)
+                            .filter((x) => x !== null);
+                        const auxCeilingMs = readEnvAuxGraceMs() ?? 2000;
+                        // After all primaries settle, give each auxiliary the smaller of
+                        // its declared wait budget and the global auxiliary ceiling. The
+                        // 2000ms default admits measured ~1.3s warm scanner runs without
+                        // making every edit pay opengrep's 3500ms cold-start allowance.
+                        // Late aux results are dropped from this wait. A later unchanged-
+                        // content read may carry a SHA-256-bound cache publication before its
+                        // resync clears the cache; changed or unknown content never replays.
+                        // Aux servers that answer within the grace are included automatically since
+                        // their waitForDiagnostics already resolved. The cut-off server ids
+                        // are logged in the latency metadata (lsp_touch_file phase, field
+                        // `auxCutOffServerIds`).
+                        return Promise.all(primaryWaits).then(async () => {
+                            if (auxWaits.length === 0)
+                                return;
+                            const auxWaitStartedAt = Date.now();
+                            const outcomes = await Promise.all(auxWaits.map(async (aux) => {
+                                const budgetMs = Math.min(timeoutFor(aux.serverId), auxCeilingMs);
+                                let timer;
+                                const timeout = new Promise((resolve) => {
+                                    timer = setTimeout(() => resolve(false), budgetMs);
+                                    if (typeof timer === "object" && "unref" in timer) {
+                                        timer.unref?.();
+                                    }
+                                });
+                                const raced = await Promise.race([
+                                    aux.promise.then(() => true),
+                                    timeout,
+                                ]);
+                                if (timer)
+                                    clearTimeout(timer);
+                                // #1458 S1: `waitForDiagnostics` RESOLVES on its own timeout
+                                // (client.ts) — it never rejects, and a silent scanner that
+                                // published nothing looks identical, promise-wise, to one
+                                // that answered. `raced === true` only means "the promise
+                                // settled before our timer fired"; it is not proof anything
+                                // was published. Decide the outcome from evidence instead:
+                                // did this aux's `diagnosticsVersion` advance past the
+                                // pre-notify baseline captured before the wait started?
+                                //   - raced === false            → "cut_off" (our timer won;
+                                //     the aux's own wait never got to answer for itself).
+                                //   - raced === true, no evidence → "silent" (the aux's own
+                                //     wait gave up within its budget with nothing to report —
+                                //     NOT the same as having answered).
+                                //   - raced === true, evidence   → "answered" (a fresh
+                                //     publication actually landed for this touch).
+                                const publishedEvidence = raced &&
+                                    Number.isFinite(aux.baseline) &&
+                                    aux.client.diagnosticsVersion > aux.baseline;
+                                const outcome = !raced
+                                    ? "cut_off"
+                                    : publishedEvidence
+                                        ? "answered"
+                                        : "silent";
+                                return {
+                                    serverId: aux.serverId,
+                                    outcome,
+                                    budgetMs,
+                                    elapsedMs: Date.now() - auxWaitStartedAt,
+                                    // #1458 S3: elapsed measured from BEFORE the primary wait
+                                    // (waitStartedAt), not just from auxWaitStartedAt — this is
+                                    // what lets a latency row validate the ~1.3s warm-scanner
+                                    // figure the 2000ms ceiling was set from; `elapsedMs` alone
+                                    // only covers the POST-primary aux phase.
+                                    elapsedSinceNotifyMs: Date.now() - waitStartedAt,
+                                };
+                            }));
+                            const unfinished = outcomes
+                                .filter((outcome) => outcome.outcome === "cut_off")
+                                .map((outcome) => outcome.serverId);
                             if (unfinished.length > 0)
                                 auxCutOffServerIds = unfinished;
+                            logLatency({
+                                type: "phase",
+                                phase: "lsp_aux_wait_outcome",
+                                filePath: normalizedPath,
+                                durationMs: Date.now() - auxWaitStartedAt,
+                                metadata: { clientScope, outcomes },
+                            });
+                        });
+                    })()
+                    : Promise.all(perServerWaits).then(() => { });
+                pushWait.then(() => {
+                    pushWaitSettled = true;
+                });
+                if (tsserverSyncEligible) {
+                    // #707 racing variant: rather than burning the full push-wait budget
+                    // on a silent-on-clean server (which by definition never answers on a
+                    // clean file), race the push wait against a grace-delayed sync
+                    // confirm. The grace (default 300ms, PI_LENS_TSSERVER_SYNC_GRACE_MS)
+                    // gives a genuinely dirty file's push a head start: if diagnostics
+                    // arrive before the grace elapses, the sync request never goes out —
+                    // zero new latency or requests on the push-answers path.
+                    //
+                    // Race semantics:
+                    //   - sync answers first → that's the confirmed result (clean OR
+                    //     dirty — the sync commands return the file's real syntactic +
+                    //     semantic state, so a dirty-file win is still correct and its
+                    //     findings are surfaced, never discarded).
+                    //   - push settles first → push wins; a still-in-flight sync outcome
+                    //     is discarded (the racer checks `pushWaitSettled` after the
+                    //     call returns and drops its own result).
+                    //   - sync unavailable/fails → the racer parks on a never-resolving
+                    //     promise so the race is decided by the push wait's own budget,
+                    //     exactly today's behavior (the end-of-wait fallback below still
+                    //     gets its shot on a timed-out empty result).
+                    // The racer never rejects (every failure path is caught), so the
+                    // losing promise can never surface as an unhandled rejection.
+                    const graceMs = readTsserverSyncGraceMs();
+                    const primaryClient = spawned[0].client;
+                    // Resolves with the sync commands' diagnostics when the confirm
+                    // succeeds; parks on a never-resolving promise on EVERY other path
+                    // (push already answered, sync unavailable/failed, push won while
+                    // in flight) so the race is then decided by the push wait's own
+                    // budget — exactly today's behavior.
+                    const syncRacer = (async () => {
+                        await new Promise((resolve) => {
+                            const timer = setTimeout(resolve, graceMs);
+                            timer.unref?.();
+                        });
+                        // Push already answered (settled, or published diagnostics that
+                        // its wait is about to settle on) — nothing to confirm, no sync
+                        // request goes out.
+                        if (pushWaitSettled ||
+                            primaryClient.getDiagnostics(filePath).length > 0) {
+                            return new Promise(() => { });
                         }
+                        try {
+                            const result = await attemptTsserverSyncDiagnostics(filePath, this);
+                            if (result === undefined || pushWaitSettled) {
+                                // Sync unavailable/failed, or push won while the sync call
+                                // was in flight — drop the sync outcome and let the push
+                                // wait decide the race.
+                                return new Promise(() => { });
+                            }
+                            return result;
+                        }
+                        catch {
+                            return new Promise(() => { });
+                        }
+                    })();
+                    const raceOutcome = await Promise.race([
+                        pushWait.then(() => undefined),
+                        syncRacer,
+                    ]);
+                    if (raceOutcome !== undefined) {
+                        tsserverSyncConfirmed = raceOutcome;
+                    }
+                }
+                else {
+                    await pushWait;
+                }
+                const waitedMs = Date.now() - waitStartedAt;
+                if (tsserverSyncConfirmed !== undefined) {
+                    // #707: the racing sync confirm won — a definitive answer well under
+                    // the push-wait budget. Not a timeout, not inconclusive.
+                    logLatency({
+                        type: "phase",
+                        phase: "lsp_tsserver_sync_confirm",
+                        filePath: normalizedPath,
+                        durationMs: waitedMs,
+                        metadata: {
+                            source,
+                            serverId: spawned[0]?.client.serverId,
+                            clientScope,
+                            diagnosticsMode,
+                            mode: "race",
+                            confirmedDiagnosticCount: tsserverSyncConfirmed.length,
+                            budgetMs: timeoutMs,
+                            savedVsBudgetMs: Math.max(0, timeoutMs - waitedMs),
+                        },
                     });
-                })()
-                : Promise.all(perServerWaits).then(() => { });
-            pushWait.then(() => {
-                pushWaitSettled = true;
-            });
-            if (tsserverSyncEligible) {
-                // #707 racing variant: rather than burning the full push-wait budget
-                // on a silent-on-clean server (which by definition never answers on a
-                // clean file), race the push wait against a grace-delayed sync
-                // confirm. The grace (default 300ms, PI_LENS_TSSERVER_SYNC_GRACE_MS)
-                // gives a genuinely dirty file's push a head start: if diagnostics
-                // arrive before the grace elapses, the sync request never goes out —
-                // zero new latency or requests on the push-answers path.
-                //
-                // Race semantics:
-                //   - sync answers first → that's the confirmed result (clean OR
-                //     dirty — the sync commands return the file's real syntactic +
-                //     semantic state, so a dirty-file win is still correct and its
-                //     findings are surfaced, never discarded).
-                //   - push settles first → push wins; a still-in-flight sync outcome
-                //     is discarded (the racer checks `pushWaitSettled` after the
-                //     call returns and drops its own result).
-                //   - sync unavailable/fails → the racer parks on a never-resolving
-                //     promise so the race is decided by the push wait's own budget,
-                //     exactly today's behavior (the end-of-wait fallback below still
-                //     gets its shot on a timed-out empty result).
-                // The racer never rejects (every failure path is caught), so the
-                // losing promise can never surface as an unhandled rejection.
-                const graceMs = readTsserverSyncGraceMs();
-                const primaryClient = spawned[0].client;
-                // Resolves with the sync commands' diagnostics when the confirm
-                // succeeds; parks on a never-resolving promise on EVERY other path
-                // (push already answered, sync unavailable/failed, push won while
-                // in flight) so the race is then decided by the push wait's own
-                // budget — exactly today's behavior.
-                const syncRacer = (async () => {
-                    await new Promise((resolve) => {
-                        const timer = setTimeout(resolve, graceMs);
-                        timer.unref?.();
-                    });
-                    // Push already answered (settled, or published diagnostics that
-                    // its wait is about to settle on) — nothing to confirm, no sync
-                    // request goes out.
-                    if (pushWaitSettled ||
-                        primaryClient.getDiagnostics(filePath).length > 0) {
-                        return new Promise(() => { });
+                }
+                else if (waitedMs + 20 >= timeoutMs) {
+                    // Within ~20 ms of the configured budget we treat it as a timeout;
+                    // the LSP didn't beat the cap. Diagnostics that arrive late still
+                    // land in the client's cache and surface on the next edit.
+                    diagnosticsTimedOut = true;
+                    for (const entry of spawned) {
+                        incrementDegradationCount({
+                            kind: "lsp-diagnostics-timeout",
+                            // `info.id` is the authoritative server identity carried by
+                            // every spawned entry. The client test doubles (and some
+                            // lightweight clients) need not expose a serverId property;
+                            // ledger recording must never abort the touch or alter #570's
+                            // timeout-preserves-last-known-diagnostics semantics.
+                            subject: entry.info.id,
+                            reason: "diagnostics wait timed out",
+                        });
                     }
+                    logLatency({
+                        type: "phase",
+                        phase: "lsp_diagnostics_timeout",
+                        filePath: normalizedPath,
+                        durationMs: waitedMs,
+                        metadata: {
+                            source,
+                            // #1444: WHICH server(s) burned the budget — without this the
+                            // ~221/day timeout rows can't be attributed to a server at all.
+                            // `info.id` (not `client.serverId`) for the same reason the
+                            // degradation ledger above uses it: test doubles and lightweight
+                            // clients need not expose `serverId`.
+                            serverIds: spawned.map((e) => e.info.id),
+                            clientScope,
+                            diagnosticsMode,
+                            timeoutMs,
+                        },
+                    });
+                }
+                // #814: capability-aware AGGREGATE wait — generalize #799's
+                // single-server (`clientScope === "primary" && spawned.length === 1`)
+                // silent-clean confirm to multi-server `clientScope: "all"` touches
+                // (`lens_diagnostics` mode=full per-file sweep, `lsp_diagnostics`
+                // `serverScope: "all"`). #799's gate never fires here (it's scoped to
+                // the primary hot path), so a scope-"all" touch where every OTHER
+                // spawned server already answered but one push-only `silentOnClean`
+                // server (marksman on a clean markdown file) never publishes still
+                // reported the WHOLE touch `inconclusive`/`diagnosticsTimedOut` even
+                // though the "silence" is exactly what that server's own known
+                // clean-behavior predicts — not an unresolved question.
+                //
+                // A spawned server counts as "still outstanding" when nothing landed
+                // in its per-file diagnostics cache for THIS touch — `getAllDiagnostics`
+                // is keyed by file and `clearDiagnosticsForPath` (`client.ts`) deletes
+                // that file's entry as part of the didOpen/didChange this touch just
+                // sent, so a present entry can only be a FRESH answer (found or a real
+                // confirmed-empty push/pull), never a stale one bleeding through from
+                // an earlier touch. This is the same "did anything publish for this
+                // file since we asked" signal `cascade-tier.ts`'s Tier-3 reconcile
+                // already trusts (#240 doctrine) — reused here, not reinvented.
+                //
+                // The touch stays inconclusive unless EVERY still-outstanding server
+                // is classified `tier3-silent` (push-only + `silentOnClean`, the same
+                // `classifyServerWaitTier` rule the single-server gate below and the
+                // cascade lane use) — one ordinary push-only straggler (still
+                // genuinely analyzing) or a pull-capable server that never answered
+                // keeps the touch cautious, matching #799's "err toward caution"
+                // posture for partial timeouts. `!notifyWriteTimedOut` (touch-wide)
+                // plus the per-server re-check below are the same "the notify write
+                // must have actually landed" conservatism #799 established — a
+                // server's silence is only evidence of "clean" when we know it saw
+                // the new content.
+                if (diagnosticsTimedOut && !notifyWriteTimedOut && clientScope === "all") {
                     try {
-                        const result = await attemptTsserverSyncDiagnostics(filePath, this);
-                        if (result === undefined || pushWaitSettled) {
-                            // Sync unavailable/failed, or push won while the sync call
-                            // was in flight — drop the sync outcome and let the push
-                            // wait decide the race.
-                            return new Promise(() => { });
+                        const outstanding = spawned.filter((entry) => !notifyWriteTimedOutServerIds.includes(entry.info.id) &&
+                            !entry.client.getAllDiagnostics().has(normalizedPath));
+                        if (outstanding.length > 0) {
+                            const snapshots = await this.getCapabilitySnapshots(filePath);
+                            const allSilent = outstanding.every((entry) => classifyServerWaitTier(entry.client.serverId, snapshots.find((s) => s.serverId === entry.client.serverId)) === "tier3-silent");
+                            if (allSilent) {
+                                // #1277: the static tier3-silent classification alone can't
+                                // tell a genuinely clean server from one that accepted the
+                                // notify write and then wedged — both look identical to
+                                // `classifyServerWaitTier`, which only reads the capability
+                                // snapshot, never the server's actual current responsiveness.
+                                // Require every still-outstanding server to answer a cheap
+                                // bounded round-trip before trusting the silence as clean;
+                                // any server that doesn't respond in time keeps the touch
+                                // inconclusive rather than confirming a possibly-dead server
+                                // clean.
+                                const liveness = await Promise.all(outstanding.map((entry) => (entry.client.pingLiveness?.() ?? Promise.resolve(true)).catch(() => false)));
+                                if (liveness.every(Boolean)) {
+                                    diagnosticsTimedOut = false;
+                                    logLatency({
+                                        type: "phase",
+                                        phase: "lsp_silent_clean_confirm",
+                                        filePath: normalizedPath,
+                                        durationMs: Date.now() - startedAt,
+                                        metadata: {
+                                            source,
+                                            clientScope,
+                                            diagnosticsMode,
+                                            aggregate: true,
+                                            serverIds: outstanding.map((entry) => entry.client.serverId),
+                                        },
+                                    });
+                                }
+                            }
                         }
-                        return result;
                     }
                     catch {
-                        return new Promise(() => { });
+                        // Fail-safe: leave `diagnosticsTimedOut` as-is — today's
+                        // inconclusive behavior, exactly like the single-server gate.
                     }
-                })();
-                const raceOutcome = await Promise.race([
-                    pushWait.then(() => undefined),
-                    syncRacer,
-                ]);
-                if (raceOutcome !== undefined) {
-                    tsserverSyncConfirmed = raceOutcome;
                 }
             }
-            else {
-                await pushWait;
-            }
-            const waitedMs = Date.now() - waitStartedAt;
-            if (tsserverSyncConfirmed !== undefined) {
-                // #707: the racing sync confirm won — a definitive answer well under
-                // the push-wait budget. Not a timeout, not inconclusive.
-                logLatency({
-                    type: "phase",
-                    phase: "lsp_tsserver_sync_confirm",
-                    filePath: normalizedPath,
-                    durationMs: waitedMs,
-                    metadata: {
-                        source,
-                        clientScope,
-                        diagnosticsMode,
-                        mode: "race",
-                        confirmedDiagnosticCount: tsserverSyncConfirmed.length,
-                        budgetMs: timeoutMs,
-                        savedVsBudgetMs: Math.max(0, timeoutMs - waitedMs),
-                    },
-                });
-            }
-            else if (waitedMs + 20 >= timeoutMs) {
-                // Within ~20 ms of the configured budget we treat it as a timeout;
-                // the LSP didn't beat the cap. Diagnostics that arrive late still
-                // land in the client's cache and surface on the next edit.
-                diagnosticsTimedOut = true;
-                logLatency({
-                    type: "phase",
-                    phase: "lsp_diagnostics_timeout",
-                    filePath: normalizedPath,
-                    durationMs: waitedMs,
-                    metadata: {
-                        source,
-                        clientScope,
-                        diagnosticsMode,
-                        timeoutMs,
-                    },
-                });
+            // #707: when the racing sync confirm won the wait, its answer IS the
+            // collected result — the file's real syntactic + semantic state straight
+            // from tsserver (clean = [], dirty = real findings that a silentOnClean
+            // server had computed but never published). Otherwise merge the push
+            // diagnostics from the client cache as always.
+            let collected = options.collectDiagnostics
+                ? tsserverSyncConfirmed !== undefined
+                    ? mergeLspDiagnostics(tsserverSyncConfirmed)
+                    : mergeLspDiagnostics([
+                        ...spawned.flatMap((entry) => entry.client.getDiagnostics(filePath)),
+                        ...carriedAuxiliary.flatMap((entry) => entry.diags),
+                    ])
+                : undefined;
+            // #1095 (P3-b): whether `collected` came from a tsserver sync confirm
+            // (`tsserverSyncRequest`) rather than the publish cache. A sync-confirmed
+            // result is authoritative for the CURRENT buffer but is NOT tied to the
+            // publish-path content binding (`diagnosticBindings`, set on publish), so
+            // composing that binding here could let a STALE publish fingerprint demote a
+            // genuinely-fresh sync answer to `false`. The end-of-wait fallback below can
+            // also set this. When true, the binding is surfaced as "unknown" (honest,
+            // non-demoting) rather than the stale publish binding.
+            let syncConfirmed = tsserverSyncConfirmed !== undefined;
+            // #707 end-of-wait fallback: when the racing confirm did NOT decide the
+            // wait (sync unavailable/failed mid-race, or push resolved as a bare
+            // timeout) and the wait timed out with an empty result on an eligible
+            // touch, give the sync clean-confirm one last shot before reporting
+            // inconclusive. `tsserverSyncEligible` already encodes every gate (notify
+            // succeeded, collecting, primary scope, tier3-silent classic typescript —
+            // native-ts7 excluded by `classifyCascadeWaitTier`). If the sync call
+            // answers (even with an empty body, which is a confirmed clean), we use
+            // those diagnostics as the confirmed result and clear the
+            // `diagnosticsTimedOut` flag so the touch is no longer treated as
+            // inconclusive. Sync diagnostics on a dirty file are surfaced, not
+            // discarded. If the sync call fails or is unavailable, we fall through to
+            // today's behavior: `inconclusive` = true, `collected` unchanged. This
+            // turns "unconfirmed after ~1000ms" into "confirmed at ~wait+sync-RTT"
+            // even when the race path couldn't answer.
+            if (diagnosticsTimedOut &&
+                tsserverSyncEligible &&
+                collected !== undefined &&
+                collected.length === 0) {
+                try {
+                    const syncResult = await attemptTsserverSyncDiagnostics(filePath, this);
+                    if (syncResult !== undefined) {
+                        // Sync answered — confirmed result (clean or with diagnostics).
+                        // Clear the timed-out flag so the touch is no longer inconclusive.
+                        diagnosticsTimedOut = false;
+                        syncConfirmed = true;
+                        collected = syncResult.length > 0
+                            ? mergeLspDiagnostics(syncResult)
+                            : [];
+                        logLatency({
+                            type: "phase",
+                            phase: "lsp_tsserver_sync_confirm",
+                            filePath: normalizedPath,
+                            durationMs: Date.now() - startedAt,
+                            metadata: {
+                                source,
+                                clientScope,
+                                diagnosticsMode,
+                                mode: "end-of-wait",
+                                confirmedDiagnosticCount: collected.length,
+                            },
+                        });
+                    }
+                }
+                catch {
+                    // Any failure here falls through to today's inconclusive behavior.
+                }
             }
-            // #814: capability-aware AGGREGATE wait — generalize #799's
-            // single-server (`clientScope === "primary" && spawned.length === 1`)
-            // silent-clean confirm to multi-server `clientScope: "all"` touches
-            // (`lens_diagnostics` mode=full per-file sweep, `lsp_diagnostics`
-            // `serverScope: "all"`). #799's gate never fires here (it's scoped to
-            // the primary hot path), so a scope-"all" touch where every OTHER
-            // spawned server already answered but one push-only `silentOnClean`
-            // server (marksman on a clean markdown file) never publishes still
-            // reported the WHOLE touch `inconclusive`/`diagnosticsTimedOut` even
-            // though the "silence" is exactly what that server's own known
-            // clean-behavior predicts — not an unresolved question.
-            //
-            // A spawned server counts as "still outstanding" when nothing landed
-            // in its per-file diagnostics cache for THIS touch — `getAllDiagnostics`
-            // is keyed by file and `clearDiagnosticsForPath` (`client.ts`) deletes
-            // that file's entry as part of the didOpen/didChange this touch just
-            // sent, so a present entry can only be a FRESH answer (found or a real
-            // confirmed-empty push/pull), never a stale one bleeding through from
-            // an earlier touch. This is the same "did anything publish for this
-            // file since we asked" signal `cascade-tier.ts`'s Tier-3 reconcile
-            // already trusts (#240 doctrine) — reused here, not reinvented.
+            // #799: generalize the "silent-clean push-only" confirm beyond
+            // typescript's active sync-command race above. That mechanism is
+            // TS-specific (`attemptTsserverSyncDiagnostics` races an actual
+            // `typescript.tsserverRequest` — no equivalent protocol exists for
+            // e.g. marksman) and is now scoped to `serverId === "typescript"`
+            // only (see the gate above), so it never fires for another
+            // `silentOnClean` server. This is the generic fallback for those
+            // servers: if the wait ran its full budget with a successful notify
+            // write and nothing published, and the live capability snapshot
+            // classifies this touch as tier3-silent (push-only + `silentOnClean`,
+            // #458's `classifyCascadeWaitTier`), that is not "still working" —
+            // `silentOnClean` means by definition this server publishes NOTHING
+            // on a clean transition, so a timeout under those conditions IS the
+            // confirmed-clean answer. `!tsserverSyncEligible` keeps this from
+            // ever double-deciding typescript's own touches — when the sync race
+            // was attempted and failed/was unavailable, typescript's existing
+            // "falls through to inconclusive, unchanged" contract (#707) is
+            // preserved exactly; typescript touches that never enter that gate
+            // (e.g. `collectDiagnostics: false`, like `ensureWarmForSweep`'s own
+            // warm-up call) are still eligible here as a genuine bonus fix. Scoped
+            // to `clientScope === "primary"`/`spawned.length === 1` exactly like
+            // the sync-eligible gate above (and like `ensureWarmForSweep`'s own
+            // `clientScope: "primary"` warm-up touch) so a multi-server
+            // with-auxiliary/all touch — where a partial timeout must stay
+            // cautious per the doc below — is never affected.
             //
-            // The touch stays inconclusive unless EVERY still-outstanding server
-            // is classified `tier3-silent` (push-only + `silentOnClean`, the same
-            // `classifyServerWaitTier` rule the single-server gate below and the
-            // cascade lane use) — one ordinary push-only straggler (still
-            // genuinely analyzing) or a pull-capable server that never answered
-            // keeps the touch cautious, matching #799's "err toward caution"
-            // posture for partial timeouts. `!notifyWriteTimedOut` (touch-wide)
-            // plus the per-server re-check below are the same "the notify write
-            // must have actually landed" conservatism #799 established — a
-            // server's silence is only evidence of "clean" when we know it saw
-            // the new content.
-            if (diagnosticsTimedOut && !notifyWriteTimedOut && clientScope === "all") {
+            // #814: this is now a SPECIAL CASE of the more general per-server gate
+            // above (the `clientScope === "all"` block right before the diagnostics-
+            // wait `if` closes) — for `spawned.length === 1`, "every still-outstanding
+            // server is tier3-silent" collapses to exactly this single-server check.
+            // Left in place unchanged (rather than deleted/rewritten to delegate to
+            // the new gate) per #814's scope: a future cleanup could fold this block
+            // into the general one once both have soaked, but that's a separate,
+            // lower-risk follow-up, not bundled into this fix.
+            if (diagnosticsTimedOut &&
+                !notifyWriteTimedOut &&
+                !tsserverSyncEligible &&
+                clientScope === "primary" &&
+                spawned.length === 1 &&
+                getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
                 try {
-                    const outstanding = spawned.filter((entry) => !notifyWriteTimedOutServerIds.includes(entry.info.id) &&
-                        !entry.client.getAllDiagnostics().has(normalizedPath));
-                    if (outstanding.length > 0) {
-                        const snapshots = await this.getCapabilitySnapshots(filePath);
-                        const allSilent = outstanding.every((entry) => classifyServerWaitTier(entry.client.serverId, snapshots.find((s) => s.serverId === entry.client.serverId)) === "tier3-silent");
-                        if (allSilent) {
+                    const snapshots = await this.getCapabilitySnapshots(filePath);
+                    if (classifyCascadeWaitTier(this, filePath, snapshots) === "tier3-silent") {
+                        // #1277: same liveness precondition as the aggregate gate above —
+                        // `tier3-silent` is a static capability classification and can't
+                        // distinguish "silent because clean" from "silent because wedged".
+                        // A cheap bounded round-trip proves the server is still actually
+                        // responding before its silence is trusted as a clean confirm; a
+                        // server that doesn't answer in time leaves the touch inconclusive.
+                        const alive = await (spawned[0].client.pingLiveness?.() ?? Promise.resolve(true)).catch(() => false);
+                        if (alive) {
                             diagnosticsTimedOut = false;
+                            if (collected !== undefined)
+                                collected = mergeLspDiagnostics([]);
                             logLatency({
                                 type: "phase",
                                 phase: "lsp_silent_clean_confirm",
@@ -1600,238 +2485,212 @@ export class LSPService {
                                     source,
                                     clientScope,
                                     diagnosticsMode,
-                                    aggregate: true,
-                                    serverIds: outstanding.map((entry) => entry.client.serverId),
+                                    serverId: spawned[0].client.serverId,
                                 },
                             });
                         }
                     }
                 }
                 catch {
-                    // Fail-safe: leave `diagnosticsTimedOut` as-is — today's
-                    // inconclusive behavior, exactly like the single-server gate.
+                    // Fail-safe: leave `diagnosticsTimedOut` as-is — today's inconclusive
+                    // behavior.
                 }
             }
-        }
-        // #707: when the racing sync confirm won the wait, its answer IS the
-        // collected result — the file's real syntactic + semantic state straight
-        // from tsserver (clean = [], dirty = real findings that a silentOnClean
-        // server had computed but never published). Otherwise merge the push
-        // diagnostics from the client cache as always.
-        let collected = options.collectDiagnostics
-            ? tsserverSyncConfirmed !== undefined
-                ? mergeLspDiagnostics(tsserverSyncConfirmed)
-                : mergeLspDiagnostics(spawned.flatMap((entry) => entry.client.getDiagnostics(filePath)))
-            : undefined;
-        // #707 end-of-wait fallback: when the racing confirm did NOT decide the
-        // wait (sync unavailable/failed mid-race, or push resolved as a bare
-        // timeout) and the wait timed out with an empty result on an eligible
-        // touch, give the sync clean-confirm one last shot before reporting
-        // inconclusive. `tsserverSyncEligible` already encodes every gate (notify
-        // succeeded, collecting, primary scope, tier3-silent classic typescript —
-        // native-ts7 excluded by `classifyCascadeWaitTier`). If the sync call
-        // answers (even with an empty body, which is a confirmed clean), we use
-        // those diagnostics as the confirmed result and clear the
-        // `diagnosticsTimedOut` flag so the touch is no longer treated as
-        // inconclusive. Sync diagnostics on a dirty file are surfaced, not
-        // discarded. If the sync call fails or is unavailable, we fall through to
-        // today's behavior: `inconclusive` = true, `collected` unchanged. This
-        // turns "unconfirmed after ~1000ms" into "confirmed at ~wait+sync-RTT"
-        // even when the race path couldn't answer.
-        if (diagnosticsTimedOut &&
-            tsserverSyncEligible &&
-            collected !== undefined &&
-            collected.length === 0) {
-            try {
-                const syncResult = await attemptTsserverSyncDiagnostics(filePath, this);
-                if (syncResult !== undefined) {
-                    // Sync answered — confirmed result (clean or with diagnostics).
-                    // Clear the timed-out flag so the touch is no longer inconclusive.
-                    diagnosticsTimedOut = false;
-                    collected = syncResult.length > 0
-                        ? mergeLspDiagnostics(syncResult)
-                        : [];
-                    logLatency({
-                        type: "phase",
-                        phase: "lsp_tsserver_sync_confirm",
-                        filePath: normalizedPath,
-                        durationMs: Date.now() - startedAt,
-                        metadata: {
-                            source,
-                            clientScope,
-                            diagnosticsMode,
-                            mode: "end-of-wait",
-                            confirmedDiagnosticCount: collected.length,
-                        },
-                    });
+            // A touch is inconclusive when EITHER the notify write or the
+            // diagnostics wait hit their deadline for ANY of the spawned servers
+            // (these flags are touch-wide, covering the whole `Promise.all` over
+            // `spawned` — see the field doc on the return type). We deliberately
+            // err toward caution here: `collected` merges diagnostics across every
+            // spawned server, so even a partial timeout (e.g. a slow auxiliary
+            // while the primary answered) means the merged result may be missing
+            // findings that just hadn't arrived yet — it must not be trusted as a
+            // confirmed answer.
+            const inconclusive = notifyWriteTimedOut || diagnosticsTimedOut;
+            // #1470: an auxiliary whose push wait was CUT OFF by the aux grace timer
+            // (R8/#714) contributed exactly as much evidence about this file as one that
+            // went silent inside its own budget — none. A hung opengrep resolved
+            // `confirmation: "confirmed"` and read as confirmed-clean on the security
+            // lane. (The SILENT case still does, and is NOT addressed here: a scanner
+            // that settles inside its own budget without publishing also yields an
+            // unqualified confirmation. Same #533 class, same lane, different door —
+            // filed as #1493, deliberately untouched by this change.)
+            // This does NOT flip the touch to inconclusive: that would discard a
+            // primary answer that IS trustworthy (#533 honesty doctrine cuts both ways —
+            // overclaiming and underclaiming are both dishonest). Instead the confirmation
+            // is NARROWED: `"partial"`, naming the servers it does not speak for, so every
+            // consumer that treats confirmation as proof of coverage fails closed while
+            // the primary's findings still flow.
+            const unconfirmedServerIds = auxCutOffServerIds ?? [];
+            const coverageGap = unconfirmedServerIds.length > 0;
+            // #667: a confirmed (non-inconclusive) diagnostics-mode touch is the
+            // "actually warm" signal `ensureWarmForSweep` waits for — mark every
+            // spawned server so a later sweep in this session sees the check as a
+            // no-op instead of paying the warm-up round trip again.
+            //
+            // #743: the diagnostics wait is a blanket (touch-wide) gate, but the
+            // notify-write timeout is now PER-SERVER — a healthy server whose sibling's
+            // write stalled must still be eligible, so only servers whose OWN write
+            // timed out are skipped here (rather than gating the whole loop on the
+            // file-level `inconclusive`).
+            //
+            // #1470: same per-server reasoning for a CUT-OFF auxiliary. "Demonstrated
+            // ready" means this server answered for this file; an auxiliary our grace
+            // timer cut off demonstrably did not.
+            //
+            // NO TEST PINS THIS LINE, and that is a property of today's readers rather
+            // than a coverage gap: `ensureWarmForSweep` filters `role === "auxiliary"`
+            // out of its server list entirely, so no reader consumes an auxiliary's
+            // `demonstratedReady` mark and deleting this `continue` changes no observable
+            // behavior (verified by mutation — the LSP suite stays green). It stays
+            // because the mark's meaning is "this server answered", and the moment any
+            // reader stops filtering auxiliaries out, marking a cut-off scanner warm
+            // would let it skip a warm-up it never earned.
+            const notifyTimedOutServerIds = new Set(notifyWriteTimedOutServerIds);
+            const cutOffServerIds = new Set(unconfirmedServerIds);
+            if (diagnosticsMode !== "none" && !diagnosticsTimedOut) {
+                for (const entry of spawned) {
+                    if (notifyTimedOutServerIds.has(entry.info.id))
+                        continue;
+                    if (cutOffServerIds.has(entry.info.id))
+                        continue;
+                    const key = await this.demonstratedReadyKeyFor(entry.info, filePath);
+                    if (key)
+                        this.markDemonstratedReadyKey(key);
                 }
             }
-            catch {
-                // Any failure here falls through to today's inconclusive behavior.
-            }
-        }
-        // #799: generalize the "silent-clean push-only" confirm beyond
-        // typescript's active sync-command race above. That mechanism is
-        // TS-specific (`attemptTsserverSyncDiagnostics` races an actual
-        // `typescript.tsserverRequest` — no equivalent protocol exists for
-        // e.g. marksman) and is now scoped to `serverId === "typescript"`
-        // only (see the gate above), so it never fires for another
-        // `silentOnClean` server. This is the generic fallback for those
-        // servers: if the wait ran its full budget with a successful notify
-        // write and nothing published, and the live capability snapshot
-        // classifies this touch as tier3-silent (push-only + `silentOnClean`,
-        // #458's `classifyCascadeWaitTier`), that is not "still working" —
-        // `silentOnClean` means by definition this server publishes NOTHING
-        // on a clean transition, so a timeout under those conditions IS the
-        // confirmed-clean answer. `!tsserverSyncEligible` keeps this from
-        // ever double-deciding typescript's own touches — when the sync race
-        // was attempted and failed/was unavailable, typescript's existing
-        // "falls through to inconclusive, unchanged" contract (#707) is
-        // preserved exactly; typescript touches that never enter that gate
-        // (e.g. `collectDiagnostics: false`, like `ensureWarmForSweep`'s own
-        // warm-up call) are still eligible here as a genuine bonus fix. Scoped
-        // to `clientScope === "primary"`/`spawned.length === 1` exactly like
-        // the sync-eligible gate above (and like `ensureWarmForSweep`'s own
-        // `clientScope: "primary"` warm-up touch) so a multi-server
-        // with-auxiliary/all touch — where a partial timeout must stay
-        // cautious per the doc below — is never affected.
-        //
-        // #814: this is now a SPECIAL CASE of the more general per-server gate
-        // above (the `clientScope === "all"` block right before the diagnostics-
-        // wait `if` closes) — for `spawned.length === 1`, "every still-outstanding
-        // server is tier3-silent" collapses to exactly this single-server check.
-        // Left in place unchanged (rather than deleted/rewritten to delegate to
-        // the new gate) per #814's scope: a future cleanup could fold this block
-        // into the general one once both have soaked, but that's a separate,
-        // lower-risk follow-up, not bundled into this fix.
-        if (diagnosticsTimedOut &&
-            !notifyWriteTimedOut &&
-            !tsserverSyncEligible &&
-            clientScope === "primary" &&
-            spawned.length === 1 &&
-            getStrategy(spawned[0].client.serverId).silentOnClean === true) {
-            try {
-                const snapshots = await this.getCapabilitySnapshots(filePath);
-                if (classifyCascadeWaitTier(this, filePath, snapshots) === "tier3-silent") {
-                    diagnosticsTimedOut = false;
-                    if (collected !== undefined)
-                        collected = mergeLspDiagnostics([]);
-                    logLatency({
-                        type: "phase",
-                        phase: "lsp_silent_clean_confirm",
-                        filePath: normalizedPath,
-                        durationMs: Date.now() - startedAt,
-                        metadata: {
-                            source,
-                            clientScope,
-                            diagnosticsMode,
-                            serverId: spawned[0].client.serverId,
-                        },
-                    });
+            // Prime the last-known cache WITH the hash of the content we just synced,
+            // so a hot-path consumer (actionable-warnings at turn_end) can verify the
+            // cached diagnostics are for the current bytes before reusing them instead
+            // of paying for a second open+wait. Only when we actually collected — a
+            // non-collecting touch (didChange-only) leaves the prior entry intact.
+            // Skip this entirely when the touch was inconclusive: an unconfirmed
+            // empty `collected` must never erase a previously-confirmed non-empty
+            // record (that's the #570 bug — a timeout silently reporting as clean
+            // and wiping out known-good diagnostic state).
+            // #1470: a PARTIAL touch is the same hazard wearing a different flag. Its
+            // merged array is missing whatever the cut-off auxiliary would have said, so
+            // priming the cache with it would let `actionable-warnings`' hash-guarded
+            // read replay a partially-covered result as an authoritative observation —
+            // and an empty one would DELETE a previously-confirmed record on the strength
+            // of a scanner that never answered. Skip the prime; the next read pays a real
+            // round trip instead of trusting an incomplete one.
+            if (collected !== undefined && !inconclusive && !coverageGap) {
+                const normalizedKey = normalizeMapKey(filePath);
+                if (collected.length > 0) {
+                    this.lastKnownDiagnostics.set(normalizedKey, collected);
+                    this.lastKnownContentHash.set(normalizedKey, this.hashContent(content));
+                }
+                else {
+                    this.lastKnownDiagnostics.delete(normalizedKey);
+                    this.lastKnownContentHash.delete(normalizedKey);
                 }
             }
-            catch {
-                // Fail-safe: leave `diagnosticsTimedOut` as-is — today's inconclusive
-                // behavior.
-            }
-        }
-        // A touch is inconclusive when EITHER the notify write or the
-        // diagnostics wait hit their deadline for ANY of the spawned servers
-        // (these flags are touch-wide, covering the whole `Promise.all` over
-        // `spawned` — see the field doc on the return type). We deliberately
-        // err toward caution here: `collected` merges diagnostics across every
-        // spawned server, so even a partial timeout (e.g. a slow auxiliary
-        // while the primary answered) means the merged result may be missing
-        // findings that just hadn't arrived yet — it must not be trusted as a
-        // confirmed answer.
-        const inconclusive = notifyWriteTimedOut || diagnosticsTimedOut;
-        // #667: a confirmed (non-inconclusive) diagnostics-mode touch is the
-        // "actually warm" signal `ensureWarmForSweep` waits for — mark every
-        // spawned server so a later sweep in this session sees the check as a
-        // no-op instead of paying the warm-up round trip again.
-        //
-        // #743: the diagnostics wait is a blanket (touch-wide) gate, but the
-        // notify-write timeout is now PER-SERVER — a healthy server whose sibling's
-        // write stalled must still be eligible, so only servers whose OWN write
-        // timed out are skipped here (rather than gating the whole loop on the
-        // file-level `inconclusive`).
-        const notifyTimedOutServerIds = new Set(notifyWriteTimedOutServerIds);
-        if (diagnosticsMode !== "none" && !diagnosticsTimedOut) {
-            for (const entry of spawned) {
-                if (notifyTimedOutServerIds.has(entry.info.id))
-                    continue;
-                const key = await this.demonstratedReadyKeyFor(entry.info, filePath);
-                if (key)
-                    this.markDemonstratedReadyKey(key);
-            }
-        }
-        // Prime the last-known cache WITH the hash of the content we just synced,
-        // so a hot-path consumer (actionable-warnings at turn_end) can verify the
-        // cached diagnostics are for the current bytes before reusing them instead
-        // of paying for a second open+wait. Only when we actually collected — a
-        // non-collecting touch (didChange-only) leaves the prior entry intact.
-        // Skip this entirely when the touch was inconclusive: an unconfirmed
-        // empty `collected` must never erase a previously-confirmed non-empty
-        // record (that's the #570 bug — a timeout silently reporting as clean
-        // and wiping out known-good diagnostic state).
-        if (collected !== undefined && !inconclusive) {
-            const normalizedKey = normalizeMapKey(filePath);
-            if (collected.length > 0) {
-                this.lastKnownDiagnostics.set(normalizedKey, collected);
-                this.lastKnownContentHash.set(normalizedKey, this.hashContent(content));
+            // #1179 (shape-5 structural fix): build the result WRAPPER. The two flags
+            // that used to ride the returned array as NON-enumerable side-channels
+            // (`Object.defineProperty(collected, ...)`, dropped by any `[...]`/`.filter`/
+            // `JSON` copy — the #1094/#1096 loss class) are now EXPLICIT ENUMERABLE
+            // fields on this wrapper. `.diags` holds the array a copy operates on, so the
+            // flags survive by construction. Field presence mirrors the old attachment
+            // conditions EXACTLY: `inconclusive` only for a confirmed-inconclusive
+            // collect, `binding` only for a collecting touch — a non-collecting touch
+            // keeps resolving `{ diags: [] }`, no flags.
+            const result = { diags: collected ?? [] };
+            if (collected !== undefined && inconclusive) {
+                result.inconclusive = true;
             }
-            else {
-                this.lastKnownDiagnostics.delete(normalizedKey);
-                this.lastKnownContentHash.delete(normalizedKey);
+            else if (collected !== undefined && coverageGap) {
+                // #1470: narrowed, not collapsed. The primary's findings ride along in
+                // `.diags` exactly as before; what changes is that the touch now states
+                // which servers it does not speak for, so no consumer can read this as a
+                // full clean bill of health.
+                result.confirmation = "partial";
+                result.unconfirmedServerIds = [...unconfirmedServerIds];
             }
-        }
-        if (collected !== undefined && inconclusive) {
-            // Non-enumerable so JSON.stringify / spread / logging of the
-            // diagnostics array is unaffected — this is a query-only bonus
-            // field, not a shape change existing array consumers need to know
-            // about.
-            Object.defineProperty(collected, "inconclusive", {
-                value: true,
-                enumerable: false,
-                configurable: true,
+            else if (collected !== undefined) {
+                // Preserve the lower-level affirmative result across consumers. In
+                // particular, the silent-clean gates above clear diagnosticsTimedOut only
+                // after a successful notify and capability-confirmed wait; reclassifying
+                // that empty array later would discard the evidence that made it clean.
+                result.confirmation = "confirmed";
+            }
+            // #1095: attach the merged content binding so a consumer can ask whether
+            // these diagnostics were computed against current disk. Composed across every
+            // spawned client so a single client whose view diverged from disk marks the
+            // whole merged result mismatched. Disk verify is lazy + memoized per
+            // (file, mtime).
+            let binding;
+            if (collected !== undefined) {
+                binding = syncConfirmed
+                    ? // #1095 (P3-b): a tsserver sync-confirmed result is authoritative for
+                        // the current buffer but not tied to the publish-path fingerprint —
+                        // surface "unknown" so a stale publish binding can't demote it.
+                        { boundToCurrentDisk: "unknown" }
+                    : this.mergeBinding(filePath, 
+                    // Optional-chain so a client without the getter (test doubles, a
+                    // partially-mocked client) yields "unknown" rather than throwing —
+                    // unknown preserves pre-#1095 behavior for that contributor.
+                    [
+                        ...spawned.map((entry) => entry.client.getDiagnosticBinding?.(filePath)),
+                        ...carriedAuxiliary.map((entry) => entry.binding),
+                    ]);
+                result.binding = binding;
+            }
+            // The recent-touches entries are recorded per server inside the notify-write
+            // loop above, at the moment each server's own write lands (#1253) — a server
+            // whose write timed out or rejected deliberately gets none, so the next touch
+            // re-pushes it rather than debouncing a failure into a later touch that looks
+            // fully delivered. Nothing to record here: a skipped server keeps its original
+            // entry (and timestamp) so its window still expires naturally instead of being
+            // extended by every reuse.
+            logLatency({
+                type: "phase",
+                phase: "lsp_touch_file",
+                filePath: normalizedPath,
+                durationMs: Date.now() - startedAt,
+                metadata: {
+                    serverCountReady: spawned.length,
+                    clientScope,
+                    diagnosticsMode,
+                    source,
+                    failureKind: "success",
+                    collectedDiagnostics: collected?.length,
+                    // #1095: observability so an unbinding server is diagnosable —
+                    // "bound" (matches disk) / "mismatch" (diverged) / "unknown"
+                    // (version-less server or disk unreadable). Absent for non-collecting
+                    // touches (no merged result to bind).
+                    ...(binding !== undefined && {
+                        bindingState: bindingStateLabel(binding.boundToCurrentDisk),
+                    }),
+                    notifySkipped,
+                    notifyWriteTimedOut,
+                    // #743: per-server detail — which servers' writes actually timed out.
+                    // Absent when none did. `notifyWriteTimedOut` is the file-level "at
+                    // least one" summary.
+                    ...(notifyWriteTimedOutServerIds.length > 0 && {
+                        notifyWriteTimedOutServerIds,
+                    }),
+                    diagnosticsTimedOut,
+                    inconclusive,
+                    // #1470: the touch's own honesty verdict, so a `cut_off` row in
+                    // `lsp_aux_wait_outcome` can be joined to the touch that produced it and
+                    // shown NOT to have claimed confirmation for that server's coverage.
+                    // Absent for a non-collecting touch, which claims nothing either way.
+                    ...(result.confirmation !== undefined && {
+                        confirmation: result.confirmation,
+                    }),
+                    // R8 (#714): server ids of auxiliaries whose push wait was cut off by
+                    // the aux grace window (primary settled clean + aux timed out in grace).
+                    // Absent when no aux was cut off. These servers' diagnostics are
+                    // advisory-only and will surface on the next edit from their cache.
+                    ...(auxCutOffServerIds !== undefined && { auxCutOffServerIds }),
+                },
             });
+            return result;
         }
-        // Only refresh the recent-touches entry when we actually pushed. Skipping
-        // here keeps the original push timestamp intact so the debounce window
-        // expires naturally instead of being extended by every reuse.
-        if (!notifySkipped) {
-            this.markTouched(filePath, content, clientScope);
+        finally {
+            for (const key of leaseKeys)
+                this.releaseClientLease(key);
         }
-        logLatency({
-            type: "phase",
-            phase: "lsp_touch_file",
-            filePath: normalizedPath,
-            durationMs: Date.now() - startedAt,
-            metadata: {
-                serverCountReady: spawned.length,
-                clientScope,
-                diagnosticsMode,
-                source,
-                failureKind: "success",
-                collectedDiagnostics: collected?.length,
-                notifySkipped,
-                notifyWriteTimedOut,
-                // #743: per-server detail — which servers' writes actually timed out.
-                // Absent when none did. `notifyWriteTimedOut` is the file-level "at
-                // least one" summary.
-                ...(notifyWriteTimedOutServerIds.length > 0 && {
-                    notifyWriteTimedOutServerIds,
-                }),
-                diagnosticsTimedOut,
-                inconclusive,
-                // R8 (#714): server ids of auxiliaries whose push wait was cut off by
-                // the aux grace window (primary settled clean + aux timed out in grace).
-                // Absent when no aux was cut off. These servers' diagnostics are
-                // advisory-only and will surface on the next edit from their cache.
-                ...(auxCutOffServerIds !== undefined && { auxCutOffServerIds }),
-            },
-        });
-        return collected ?? [];
     }
     /**
      * Get diagnostics for a file
@@ -1916,7 +2775,8 @@ export class LSPService {
         }
         const clientWaits = spawned.map(async (entry) => {
             const waitStart = Date.now();
-            const strategy = getStrategy(entry.info.id);
+            const launchVariant = entry.client.getLaunchVariant?.();
+            const strategy = getStrategy(entry.info.id, launchVariant);
             await entry.client.waitForDiagnostics(filePath, strategy.aggregateWaitMs);
             let diagnostics = entry.client.getDiagnostics(filePath);
             const firstWaitMs = Date.now() - waitStart;
@@ -1928,6 +2788,7 @@ export class LSPService {
             }
             return {
                 serverId: entry.info.id,
+                launchVariant,
                 waitMs: Date.now() - waitStart,
                 diagnosticCount: diagnostics.length,
                 diagnostics,
@@ -1936,25 +2797,48 @@ export class LSPService {
         // Document mode: 0ms grace — return as soon as any client has results.
         // Full mode: 400ms grace — wait a bit for other clients to catch up.
         const graceMs = diagnosticsMode === "document" ? 0 : EARLY_UNBLOCK_GRACE_MS;
-        // R8 (#714): per-promise role descriptors so raceToCompletion can apply
-        // a bounded aux grace once all primary-role promises have settled.
-        // Servers with role:"auxiliary" (opengrep, ast-grep, zizmor, …) get at
-        // most PI_LENS_AUX_GRACE_MS (default 500ms) after the primary settles;
-        // late arrivals are dropped (advisory only — they land in the client
+        // R8 (#714) / #1458 S2: per-promise role descriptors so raceToCompletion
+        // can apply a bounded aux grace once all primary-role promises have
+        // settled. Servers with role:"auxiliary" (opengrep, ast-grep, zizmor, …)
+        // get their OWN declared `aggregateWaitMs` budget after the primary
+        // settles, capped by the PI_LENS_AUX_GRACE_MS global ceiling (default
+        // 2000ms) — the same "declared budget, capped by a ceiling" shape
+        // `touchFile`'s with-auxiliary push wait uses, so this lane can no longer
+        // starve a scanner whose measured warm run (e.g. opengrep ~1.3s) is
+        // shorter than the ceiling but longer than a flat short grace. Late
+        // arrivals are still dropped (advisory only — they land in the client
         // cache and surface on the next edit). Primary-only callers have no
         // auxiliary descriptors, so this path is never entered and there is
         // zero behavior change for the single-server hot path.
-        const diagDescriptors = spawned.map((entry) => ({
-            role: entry.info.role === "auxiliary" ? "auxiliary" : "primary",
-        }));
+        const diagDescriptors = spawned.map((entry) => {
+            if (entry.info.role !== "auxiliary")
+                return { role: "primary" };
+            const strategy = getStrategy(entry.info.id, entry.client.getLaunchVariant?.());
+            // Deleting this `budgetMs` fails no end-to-end test, and that is
+            // expected rather than a coverage gap: every promise in `clientWaits`
+            // already self-bounds at this same `strategy.aggregateWaitMs`, so an
+            // auxiliary cuts itself off at its declared budget whether or not the
+            // shared grace timer also knows about it. The descriptor is what keeps
+            // the two agreeing — it is the mitigation for the over-granting
+            // `raceToCompletion` documents, and it starts mattering the moment a
+            // promise here stops self-bounding. The narrowing itself is pinned in
+            // tests/clients/lsp/aggregation.test.ts, which can build the
+            // non-self-bounded promises this path cannot.
+            return { role: "auxiliary", budgetMs: strategy.aggregateWaitMs };
+        });
         // Result-aware racing: trigger early-unblock when any client has results,
         // OR when a seedFirstPush server returns (its first push is authoritative
         // even when empty — waiting longer yields nothing more).
-        const perServer = await raceToCompletion(clientWaits, (results) => results.some((r) => r.diagnosticCount > 0 || getStrategy(r.serverId).seedFirstPush), {
-            timeoutMs: Math.max(...spawned.map((entry) => getStrategy(entry.info.id).aggregateWaitMs)),
+        const perServer = await raceToCompletion(clientWaits, (results) => results.some((r) => r.diagnosticCount > 0 ||
+            getStrategy(r.serverId, r.launchVariant).seedFirstPush), {
+            timeoutMs: Math.max(...spawned.map((entry) => getStrategy(entry.info.id, entry.client.getLaunchVariant?.())
+                .aggregateWaitMs)),
             graceMs,
             descriptors: diagDescriptors,
-            auxGraceMs: readEnvAuxGraceMs(),
+            // #1458 S2: ceiling, not a flat wait — each auxiliary's own
+            // budgetMs (above) determines the actual per-touch grace up to
+            // this cap. Matches touchFile's `readEnvAuxGraceMs() ?? 2000`.
+            auxGraceMs: readEnvAuxGraceMs() ?? 2000,
         });
         // Fill in any slots that timed out before producing results.
         const earlyUnblockedCount = spawned.length - perServer.length;
@@ -1962,7 +2846,8 @@ export class LSPService {
             const found = perServer.find((r) => r.serverId === entry.info.id);
             return (found ?? {
                 serverId: entry.info.id,
-                waitMs: getStrategy(entry.info.id).aggregateWaitMs,
+                launchVariant: entry.client.getLaunchVariant?.(),
+                waitMs: getStrategy(entry.info.id, entry.client.getLaunchVariant?.()).aggregateWaitMs,
                 diagnosticCount: 0,
                 diagnostics: [],
             });
@@ -2036,6 +2921,40 @@ export class LSPService {
     hashContent(content) {
         return createHash("sha256").update(content).digest("hex");
     }
+    /**
+     * #1095: compose the content `binding` for a merged diagnostics result across
+     * the clients that contributed to it (primary + any auxiliaries). Verifies
+     * each contributor's stored binding against current disk lazily (memoized per
+     * file+mtime by {@link diskBindingCache}) and composes per
+     * {@link composeBoundToCurrentDisk}: ANY contributor mismatches disk → false;
+     * else all "unknown" (or no contributors) → "unknown"; else true. The
+     * surfaced version/contentHash come from the first contributor that carries
+     * them — informational only; the load-bearing field is `boundToCurrentDisk`.
+     * #1104: `version` and `contentHash` are tracked INDEPENDENTLY (not gated on
+     * the same contributor carrying both) — a pull-sourced binding deliberately
+     * has no `version` (the pull protocol has no version-echo concept) but does
+     * carry a real `contentHash`; gating the latter on the former would silently
+     * drop it here even though `boundToCurrentDisk` above already used it.
+     */
+    mergeBinding(filePath, stored) {
+        const verdicts = [];
+        let version;
+        let contentHash;
+        for (const entry of stored) {
+            verdicts.push(this.diskBindingCache.boundToCurrentDisk(filePath, entry ?? {}));
+            if (version === undefined && entry?.version !== undefined) {
+                version = entry.version;
+            }
+            if (contentHash === undefined && entry?.contentHash !== undefined) {
+                contentHash = entry.contentHash;
+            }
+        }
+        return {
+            version,
+            contentHash,
+            boundToCurrentDisk: composeBoundToCurrentDisk(verdicts),
+        };
+    }
     /**
      * Navigation: go to definition
      */
@@ -2134,18 +3053,18 @@ export class LSPService {
      * advertisement in the client). If filePath is given, target that file's
      * server; otherwise the first active client.
      */
-    async executeCommand(filePath, command, args) {
+    async executeCommand(filePath, command, args, mutationContext) {
         if (filePath) {
             const spawned = await this.getClientForFile(filePath, NAV_CLIENT_WAIT_TIMEOUT_MS);
             if (!spawned) {
                 return { executed: false, reason: "no LSP server for file" };
             }
-            return spawned.client.executeCommand(command, args);
+            return spawned.client.executeCommand(command, args, mutationContext);
         }
         const first = this.state.clients.values().next().value;
         if (!first)
             return { executed: false, reason: "no active LSP server" };
-        return first.executeCommand(command, args);
+        return first.executeCommand(command, args, mutationContext);
     }
     /**
      * Capability snapshot for LSP operations.
@@ -2180,7 +3099,7 @@ export class LSPService {
         if (filePath) {
             const servers = getServersForFileWithConfig(filePath);
             for (const server of servers) {
-                const root = await server.root(filePath);
+                const root = await this.resolveServerRoot(server, filePath);
                 if (!root)
                     continue;
                 const client = this.state.clients.get(`${server.id}:${normalizeMapKey(root)}`);
@@ -2254,6 +3173,20 @@ export class LSPService {
     async renameFile(oldFilePath, newFilePath, options) {
         const cwd = options.cwd;
         const apply = options.apply ?? false;
+        // Validate the complete resource operation before asking any server for
+        // willRenameFiles edits. This is a read-only preflight, but it reuses the
+        // same confinement, realpath/symlink, existence, and destination checks as
+        // the eventual apply path, so an invalid rename cannot first mutate an
+        // in-workspace file through returned text edits (including previews).
+        await validateWorkspaceEdit({
+            documentChanges: [
+                {
+                    kind: "rename",
+                    oldUri: pathToFileURL(oldFilePath).href,
+                    newUri: pathToFileURL(newFilePath).href,
+                },
+            ],
+        }, cwd);
         const priorityServerIds = getServersForFileWithConfig(oldFilePath).map((server) => server.id);
         const activeClients = this.activeClientsForCwd(cwd, priorityServerIds);
         const willRenameFailures = [];
@@ -2290,25 +3223,142 @@ export class LSPService {
                 summary,
             };
         }
-        const applied = await applyWorkspaceEdit(merged.edit, cwd);
-        await fs.mkdir(path.dirname(newFilePath), { recursive: true });
-        await fs.rename(oldFilePath, newFilePath);
+        let applied;
+        try {
+            applied = await applyWorkspaceEdit(merged.edit, cwd, {
+                mutationContext: options.mutationContext,
+                observe: false,
+            });
+        }
+        catch (err) {
+            if (options.mutationContext) {
+                const partial = err
+                    .appliedWorkspaceEdit;
+                if (partial) {
+                    recordLspMutation(options.mutationContext, {
+                        results: [partial],
+                        status: "failed",
+                    });
+                }
+            }
+            throw err;
+        }
+        const openDocuments = activeClients
+            .filter(({ client }) => client.isDocumentOpen(oldFilePath))
+            .map(({ serverId, client }) => ({
+            serverId,
+            client,
+            oldUri: client.getDocumentUri(oldFilePath),
+        }));
+        const closeFailures = [];
+        await Promise.all(openDocuments.map(async ({ serverId, client }) => {
+            try {
+                await client.closeDocument(oldFilePath);
+                return undefined;
+            }
+            catch (err) {
+                closeFailures.push({
+                    serverId,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                return undefined;
+            }
+        }));
+        if (closeFailures.length > 0) {
+            if (options.mutationContext) {
+                recordLspMutation(options.mutationContext, {
+                    results: [applied],
+                    status: "failed",
+                });
+            }
+            // Do not rename or send didRenameFiles while any server still has the
+            // old document open. Re-open/resync every affected client so a partial
+            // close cannot leave an in-memory document behind the disk contents.
+            // Reopen with the document's ACTUAL language ID (the same resolver every
+            // genuine open uses) rather than a hardcoded "plaintext" fallback — a
+            // wrong languageId here degrades that server's diagnostics until the
+            // next genuine open (#1147 P3-7).
+            const content = await fs.readFile(oldFilePath, "utf-8");
+            const languageId = getLanguageId(oldFilePath) ?? "plaintext";
+            await Promise.all(openDocuments.map(({ client }) => client.notify.open(oldFilePath, content, languageId, true, true)));
+            throw new Error(`workspace/didClose failed; rename aborted: ${closeFailures.map((failure) => `${failure.serverId}: ${failure.error}`).join("; ")}`);
+        }
+        let renameApplied;
+        try {
+            // Route the resource mutation through the same preflight confinement,
+            // realpath and symlink policy as all other workspace edits. Do not
+            // duplicate that security boundary with a direct mkdir/rename pair.
+            renameApplied = await applyWorkspaceEdit({
+                documentChanges: [
+                    {
+                        kind: "rename",
+                        oldUri: pathToFileURL(oldFilePath).href,
+                        newUri: pathToFileURL(newFilePath).href,
+                    },
+                ],
+            }, cwd, { observe: false });
+        }
+        catch (err) {
+            if (options.mutationContext) {
+                recordLspMutation(options.mutationContext, {
+                    results: [applied],
+                    status: "failed",
+                });
+            }
+            throw err;
+        }
         const relOld = path.relative(cwd, oldFilePath).replace(/\\/g, "/") ||
             path.basename(oldFilePath);
         const relNew = path.relative(cwd, newFilePath).replace(/\\/g, "/") ||
             path.basename(newFilePath);
         const renameDescription = `Renamed ${relOld} → ${relNew}`;
         await Promise.all(activeClients.map(async ({ serverId, client }) => {
+            const opened = openDocuments.find((entry) => entry.serverId === serverId);
             try {
-                await client.didRenameFiles(oldFilePath, newFilePath);
+                if (opened?.oldUri) {
+                    await client.didRenameFiles(oldFilePath, newFilePath, opened.oldUri, destinationUriPreservingSpelling(opened.oldUri, oldFilePath, newFilePath));
+                }
+                else {
+                    await client.didRenameFiles(oldFilePath, newFilePath);
+                }
+                return undefined;
             }
             catch (err) {
                 didRenameFailures.push({
                     serverId,
                     error: err instanceof Error ? err.message : String(err),
                 });
+                return undefined;
             }
         }));
+        const files = [...new Set([...applied.files, oldFilePath, newFilePath])];
+        if (options.mutationContext) {
+            recordLspMutation(options.mutationContext, {
+                results: [
+                    {
+                        ...applied,
+                        files,
+                        operationTotal: applied.operationTotal + renameApplied.operationTotal,
+                        appliedOperationTotal: applied.appliedOperationTotal + renameApplied.appliedOperationTotal,
+                        appliedOperationIndexes: [
+                            ...applied.appliedOperationIndexes,
+                            ...renameApplied.appliedOperationIndexes.map((index) => applied.operationTotal + index),
+                        ],
+                        operationCounts: {
+                            textEdits: applied.operationCounts.textEdits + renameApplied.operationCounts.textEdits,
+                            create: applied.operationCounts.create + renameApplied.operationCounts.create,
+                            rename: applied.operationCounts.rename + renameApplied.operationCounts.rename,
+                            delete: applied.operationCounts.delete + renameApplied.operationCounts.delete,
+                        },
+                        fileDetails: [
+                            ...applied.fileDetails,
+                            ...renameApplied.fileDetails,
+                        ],
+                    },
+                ],
+                status: "success",
+            });
+        }
         return {
             applied: true,
             serverIds: activeClients.map((entry) => entry.serverId),
@@ -2318,7 +3368,7 @@ export class LSPService {
             inputEditCount: merged.inputEditCount,
             summary,
             descriptions: [...applied.descriptions, renameDescription],
-            files: [...new Set([...applied.files, oldFilePath, newFilePath])],
+            files,
         };
     }
     /**
@@ -2556,16 +3606,21 @@ export class LSPService {
                     ms: timeoutMs,
                     onTimeout: "undefined",
                 }));
+            const coldServerIds = stillColdServerIds();
             logLatency({
                 type: "phase",
-                phase: "lsp_sweep_warmup_done",
+                phase: options.signal?.aborted
+                    ? "lsp_sweep_warmup_aborted"
+                    : coldServerIds.length > 0
+                        ? "lsp_sweep_warmup_failed"
+                        : "lsp_sweep_warmup_done",
                 filePath: representativeFile,
                 durationMs: Date.now() - startedAt,
                 metadata: {
                     serverIds: servers.map((s) => s.id),
                     timeoutMs,
                     attempt,
-                    coldServerIds: stillColdServerIds(),
+                    coldServerIds,
                 },
             });
         };
@@ -2591,13 +3646,6 @@ export class LSPService {
             }
         }
         if (failedServerIds.length > 0) {
-            logLatency({
-                type: "phase",
-                phase: "lsp_sweep_warmup_failed",
-                filePath: representativeFile,
-                durationMs: 0,
-                metadata: { failedServerIds, timeoutMs },
-            });
             // #799: record the negative cache so a LATER sweep this session
             // skips straight past re-paying this warm-up (initial + retry).
             // Cleared automatically the moment the server demonstrates
@@ -2659,13 +3707,31 @@ export class LSPService {
         ]);
         const cachedResults = [];
         const filesToTouch = [];
+        const writeIndexByPath = new Map();
         for (const filePath of files) {
+            // Reserve order before cache lookup/touch admission. A result that settles
+            // later is still ordered by when this scan began observing the file (#1198).
+            writeIndexByPath.set(normalizeMapKey(filePath), options.nextWriteIndex?.());
             const cached = workspaceDiagnosticsCacheCtx.lookup(filePath, workspaceSweepScopeKey);
-            if (cached) {
+            // #1095 (P2-1 bug-class sweep): both sweeps share cache entries under the
+            // same scopeKey, so this service sweep must apply the SAME content-binding
+            // gate the tools/lsp-diagnostics.ts sibling site does — an entry whose
+            // recorded fingerprint no longer matches disk (bytes changed WITHOUT an
+            // mtime bump the freshness check would catch, exactly what contentHash
+            // exists to detect) must NOT be replayed and reconciled as confirmed via
+            // mode=full. On a mismatch, fall through to a fresh touch.
+            if (cached && cached.binding.boundToCurrentDisk !== false) {
                 cachedResults.push({
                     filePath,
                     diagnostics: cached.diagnostics,
                     count: cached.count,
+                    // #1093: a cache hit replays an older observation — carry its
+                    // scan time so mode=full's footer reconcile stamps `touchedAt`
+                    // with when the truth was seen, not now().
+                    observedAt: cached.scannedAt,
+                    contentHash: cached.binding.contentHash,
+                    boundToCurrentDisk: cached.binding.boundToCurrentDisk,
+                    writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
                 });
             }
             else {
@@ -2847,8 +3913,26 @@ export class LSPService {
                 if (attached && !attached.available) {
                     await this.ensureWarmForSweep(filePath, { signal });
                 }
-                const diagnostics = attached?.available
-                    ? attached.response.diagnostics
+                // #1179 (shape-5 structural fix): normalize both sources into the
+                // `TouchFileResult` wrapper shape so the flag reads below come off
+                // EXPLICIT fields, not a non-enumerable side-channel a copy would drop.
+                // The warm-attach IPC branch resolves a plain diagnostics array with
+                // `inconclusive` re-surfaced as an enumerable DTO field (the socket can
+                // carry no binding, and the IPC client already rejects an inconclusive
+                // answer, so `available` implies confirmed) — wrap it as `{ diags }`;
+                // the incumbent branch already returns the wrapper.
+                const touchResult = attached?.available
+                    ? {
+                        diags: attached.response.diagnostics,
+                        // #1470: the incumbent's coverage gap crosses the socket as an
+                        // explicit DTO field, so carry it onto the wrapper the sweep
+                        // reads. Dropping it here would let a partially covered
+                        // incumbent answer be persisted as a confirmed sweep result —
+                        // the same false clean this change closes on the local route.
+                        ...(attached.response.unconfirmedServerIds !== undefined && {
+                            unconfirmedServerIds: attached.response.unconfirmedServerIds,
+                        }),
+                    }
                     : await withDeadline(this.touchFile(filePath, content, {
                         diagnostics: "document",
                         collectDiagnostics: true,
@@ -2863,17 +3947,34 @@ export class LSPService {
                         // full wait budget only once across this whole sweep.
                         sweepIndexGate,
                     }), { ms: perFileMs, onTimeout: "undefined" });
+                const diagnostics = touchResult?.diags;
                 // #571: prefer #570's real per-touch inconclusive signal
-                // (`touchFile`'s non-enumerable `.inconclusive` flag — set when the
-                // notify write or the diagnostics wait itself timed out) over this
-                // sweep's own OUTER `perFileMs` deadline, which only catches a touch
-                // that never returned at all within budget. Either one means the
-                // result wasn't confirmed.
-                const inconclusive = diagnostics
-                    ?.inconclusive === true;
-                const timedOut = diagnostics === undefined || inconclusive;
+                // (`touchFile`'s `.inconclusive` flag — set when the notify write or the
+                // diagnostics wait itself timed out) over this sweep's own OUTER
+                // `perFileMs` deadline, which only catches a touch that never returned at
+                // all within budget. Either one means the result wasn't confirmed.
+                const inconclusive = touchResult?.inconclusive === true;
+                // #1470: a cut-off auxiliary is the THIRD reason this result is not a
+                // confirmed observation, and it is deliberately not `inconclusive`. The
+                // record loop below persists every `!timedOut` result into the workspace
+                // cache, so reading `inconclusive` alone caches a partially covered
+                // answer as clean and replays it on every later sweep. Today the only
+                // route that can reach this branch with a gap is the warm-attach
+                // incumbent, whose touch runs `clientScope: "with-auxiliary"`; the
+                // sweep's own local touch uses `clientScope: "all"`, which never arms
+                // the aux grace timer at all. Both are gated here so a future scope
+                // change cannot reopen the hole silently.
+                const coverageGap = touchCoverageGap(touchResult).length > 0;
+                const timedOut = touchResult === undefined || inconclusive || coverageGap;
                 if (timedOut)
                     timedOutFiles += 1;
+                // #1104 (shape 5 — AGENTS.md): the touch's content binding is an
+                // EXPLICIT enumerable field on the wrapper now (#1179), so it survives
+                // `applyAuxiliarySuppressions` below rebuilding `.diags` via `.filter()`
+                // — read it off `touchResult`, not off the derived array. A version-
+                // less/pull-less server composed no binding, so `contentHash` stays
+                // undefined here (honest "unknown" downstream), matching prior behavior.
+                const rawBinding = touchResult?.binding;
                 // #586: honor each auxiliary profile's native inline-suppression
                 // comment (e.g. opengrep's `// nosemgrep`, #441) — computed from the
                 // raw `diagnostics` (before this drops its non-enumerable
@@ -2897,6 +3998,9 @@ export class LSPService {
                     diagnostics: filteredDiagnostics ?? [],
                     count: filteredDiagnostics?.length ?? 0,
                     timedOut,
+                    contentHash: rawBinding?.contentHash,
+                    boundToCurrentDisk: rawBinding?.boundToCurrentDisk,
+                    writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
                 });
             }
             catch (err) {
@@ -2909,6 +4013,7 @@ export class LSPService {
                     // no confirmed result was obtained, so reconciliation (#571) must
                     // skip it the same way.
                     timedOut: true,
+                    writeIndex: writeIndexByPath.get(normalizeMapKey(filePath)),
                 });
             }
             completed += 1;
@@ -2948,7 +4053,10 @@ export class LSPService {
                 const pulled = await this.tryWorkspacePull(group.files, perFileMs);
                 if (pulled) {
                     for (const result of pulled) {
-                        results.push(result);
+                        results.push({
+                            ...result,
+                            writeIndex: writeIndexByPath.get(normalizeMapKey(result.filePath)),
+                        });
                         // #671: a pull result is always confirmed (see
                         // `tryWorkspacePull`'s doc comment), so it's cache-eligible
                         // too — best-effort stat since the pull already resolved the
@@ -3072,7 +4180,15 @@ export class LSPService {
             const scannedAt = scannedMtimeByFile.get(result.filePath);
             if (result.error || result.timedOut || scannedAt === undefined)
                 continue;
-            workspaceDiagnosticsCacheCtx.record(result.filePath, workspaceSweepScopeKey, result.diagnostics, scannedAt);
+            // #1104: thread the per-result `contentHash` (from either the
+            // `tryWorkspacePull` fast path or a per-file touch's own #1095 binding)
+            // into the cache entry — previously this call never passed one, so
+            // every pull-served entry read binding "unknown" forever and the #1095
+            // P2-1 service-sweep binding gate above (`cached.binding.
+            // boundToCurrentDisk !== false`) could never demote a pull-cached
+            // entry. Absent `contentHash` (no binding was available) behaves
+            // exactly as before.
+            workspaceDiagnosticsCacheCtx.record(result.filePath, workspaceSweepScopeKey, result.diagnostics, scannedAt, result.contentHash);
         }
         workspaceDiagnosticsCacheCtx.persist();
         return [...cachedResults, ...results].filter(Boolean);
@@ -3099,14 +4215,24 @@ export class LSPService {
                 return undefined;
             const byPath = new Map();
             for (const entry of report) {
-                byPath.set(normalizeMapKey(entry.filePath), entry.diagnostics);
+                byPath.set(normalizeMapKey(entry.filePath), entry);
             }
             return groupFiles.map((filePath) => {
-                const diagnostics = byPath.get(normalizeMapKey(filePath)) ?? [];
+                const entry = byPath.get(normalizeMapKey(filePath));
+                const diagnostics = entry?.diagnostics ?? [];
                 // A pull that got here returned a real workspace/diagnostic report
                 // (see the `!report` guard above) — always confirmed, unlike a
                 // per-file touchFile default-empty on timeout.
-                return { filePath, diagnostics, count: diagnostics.length, timedOut: false };
+                // #1104: `contentHash` comes straight from the client's pull layer —
+                // a file absent from the report (reported "clean" here) carries none,
+                // same honest "unknown" the record site already applies for it.
+                return {
+                    filePath,
+                    diagnostics,
+                    count: diagnostics.length,
+                    timedOut: false,
+                    contentHash: entry?.contentHash,
+                };
             });
         }
         catch {
@@ -3118,6 +4244,9 @@ export class LSPService {
      */
     async getAllDiagnostics() {
         const all = new Map();
+        // #1095: per-file stored bindings across every contributing client, merged
+        // into one `boundToCurrentDisk` verdict after the client loop.
+        const bindingsByPath = new Map();
         const now = Date.now();
         for (const [_key, client] of this.state.clients) {
             // Resolve existence asynchronously (was a blocking existsSync per tracked
@@ -3150,8 +4279,35 @@ export class LSPService {
                 else {
                     all.set(filePath, { diags: [...entry.diags], ts: entry.ts });
                 }
+                const list = bindingsByPath.get(filePath) ?? [];
+                list.push(entry.binding);
+                bindingsByPath.set(filePath, list);
             }
         }
+        // #1095 (P2-2): expose the composed content binding per file LAZILY — the
+        // disk stat+hash verify only runs when a consumer actually reads `.binding`.
+        // The current caller (the cascade, once per edit turn) does NOT read it yet
+        // (binding adoption in cascade/integration.ts is deferred to the second PR),
+        // so this leaves ZERO eager disk cost while still surfacing the field for the
+        // consumer that arrives next. Non-enumerable so incidental spread/serialize
+        // (e.g. logging) can't trigger a stat storm; memoized per entry so repeated
+        // reads verify once.
+        // #1179: DELIBERATELY NOT migrated to an enumerable wrapper field (unlike the
+        // `touchFile` flags). Enumerable would make an incidental `{...entry}`/serialize
+        // eagerly fire this getter and stat every file — the exact stat storm the
+        // laziness above exists to prevent. It therefore stays on the read-off-original
+        // carriage contract (see `DiagnosticBinding`): every consumer reads `.binding`
+        // off the ORIGINAL Map entry (`clients/dispatch/integration.ts` reads it off
+        // `entry`, never a copy), and the cascade's TTL gate reads it only when fresh.
+        for (const [filePath, entry] of all) {
+            const stored = bindingsByPath.get(filePath) ?? [];
+            let memo;
+            Object.defineProperty(entry, "binding", {
+                enumerable: false,
+                configurable: true,
+                get: () => (memo ??= this.mergeBinding(filePath, stored)),
+            });
+        }
         return all;
     }
     /**
@@ -3186,6 +4342,9 @@ export class LSPService {
         if (this.checkDestroyed())
             return;
         this.isDestroyed = true;
+        for (const key of this.typeScriptIdleTimers.keys()) {
+            this.clearTypeScriptIdleTimer(key);
+        }
         // Belt-and-braces: wait for any in-flight spawns so that Guard 1/2 in
         // spawnClient can observe isDestroyed and clean up. Skip on the
         // process-exiting path — the event loop is closing and we must not block.
@@ -3237,12 +4396,69 @@ export class LSPService {
     getStatus() {
         return Array.from(this.state.clients.entries()).map(([key, client]) => {
             const [serverId, root] = key.split(":");
-            return { serverId, root, connected: client.isAlive() };
+            return {
+                serverId,
+                root,
+                connected: client.isAlive(),
+                pullFailureHistory: (client.getPullFailureHistory?.() ?? []).map((entry) => ({
+                    ...entry,
+                    message: entry.message.slice(0, 200),
+                })),
+            };
         });
     }
+    /**
+     * #1142 windowed-rate breaker (composes with the {@link runtimeExitCounts}
+     * fast path — see that field and {@link RUNTIME_EXIT_WINDOW_MS}).
+     *
+     * Records one non-intentional death and returns true iff this death pushes
+     * the rolling window to {@link RUNTIME_EXIT_WINDOW_TRIP_COUNT} deaths, i.e.
+     * the breaker should give up now. The caller has ALREADY excluded intentional
+     * teardowns (shutdown()-driven restarts, #743 eviction, session resets,
+     * generation handoffs) — only genuine crash-respawns reach here.
+     *
+     * Sleep-gap / long-healthy-run guard: a death whose measured lifetime exceeds
+     * {@link RUNTIME_EXIT_WINDOW_UPTIME_CEILING_MS} (or is unknown) is NOT
+     * recorded — a lifetime spanning a Modern-Standby suspend, or a genuinely
+     * long run that crashed once, is not churn. See that constant for the
+     * per-KEY structural defense this backs up.
+     *
+     * Bounded on both axes (defect shape 9): prune entries outside the window,
+     * then hard-cap the retained array at the trip count (drop-oldest — a rate
+     * trip needs only the in-window count, so earliest-evidence order is
+     * irrelevant here).
+     */
+    recordRuntimeExitWindow(key, exitedAt, uptimeMs) {
+        if (exitedAt == null ||
+            uptimeMs == null ||
+            uptimeMs > RUNTIME_EXIT_WINDOW_UPTIME_CEILING_MS) {
+            return false;
+        }
+        const deaths = this.runtimeExitWindow.get(key) ?? [];
+        deaths.push(exitedAt);
+        // Roll the window around the most recent death. `exitedAt` is the client's
+        // own recorded death time (#1127), which can arrive out of DETECTION order
+        // — a death detected hours later still carries its true, older timestamp —
+        // so anchor on the max, not on push order.
+        const windowRef = Math.max(...deaths);
+        const windowStart = windowRef - RUNTIME_EXIT_WINDOW_MS;
+        let pruned = deaths.filter((t) => t >= windowStart);
+        if (pruned.length > RUNTIME_EXIT_WINDOW_TRIP_COUNT) {
+            pruned = pruned.slice(pruned.length - RUNTIME_EXIT_WINDOW_TRIP_COUNT);
+        }
+        this.runtimeExitWindow.set(key, pruned);
+        return pruned.length >= RUNTIME_EXIT_WINDOW_TRIP_COUNT;
+    }
     /**
      * Read-only circuit-breaker status, including server/root pairs that have no
      * live client and would therefore be absent from getStatus().
+     *
+     * #1127: `failureCounts` (spawn/init failures) and `runtimeExitCounts`
+     * (early post-init runtime exits) are two INDEPENDENT streams feeding one
+     * circuit — either can trip its own cooldown/permanent-disable on its own
+     * threshold, without the other. `failures` below is their SUM, purely for
+     * display: it is the total churn behind whatever cooldown/permanent state
+     * is showing, not a claim that both streams are at that count.
      */
     getBrokenStatus() {
         const keys = new Set([
@@ -3254,7 +4470,16 @@ export class LSPService {
             return {
                 serverId: separator >= 0 ? key.slice(0, separator) : key,
                 root: separator >= 0 ? key.slice(separator + 1) : "",
-                failures: this.failureCounts.get(key) ?? 0,
+                // #1127/#1142: spawn/init failures, consecutive early post-init
+                // exits, and the windowed-rate stream all feed the same breaker
+                // (see `runtimeExitCounts`/`runtimeExitWindow` docs). Sum spawn/init
+                // failures with the LARGER of the two runtime-exit streams — a
+                // single <60s death feeds BOTH runtimeExitCounts and the window, so
+                // `max` avoids double-counting them, while still surfacing a
+                // windowed-only trip (whose runtimeExitCounts may be 0) instead of
+                // misreporting `failures: 0` behind a permanent-disable.
+                failures: (this.failureCounts.get(key) ?? 0) +
+                    Math.max(this.runtimeExitCounts.get(key) ?? 0, this.runtimeExitWindow.get(key)?.length ?? 0),
                 permanentlyBroken: this.permanentlyBroken.has(key),
                 cooldownUntil: this.state.broken.get(key) ?? 0,
             };