@herbertgao/pi-extensions 2026.8.5 → 2026.8.6

package/node_modules/pi-lens/dist/clients/lsp/index.js

@@ -22,10 +22,10 @@ import { incrementDegradationCount, recordDegradation, recordDegradationOnce, }
 import { isLspSpawnAllowedByTrust, assertInstallAllowed, projectTrustDenialReason, } from "../project-trust.js";
 import { shouldPreferPullOnlyDiagnostics } from "../lsp-budget.js";
 import { withDeadline } from "../deadline-utils.js";
-import { isAtOrAboveHomeDir, normalizeMapKey, uriToPath, } from "../path-utils.js";
+import { isAtOrAboveHomeDir, isWindowsPath, normalizeMapKey, uriToPath, } from "../path-utils.js";
 import { recordLspMutation, } from "../lsp-mutation.js";
 import { createLSPClient } from "./client.js";
-import { bindingStateLabel, composeBoundToCurrentDisk, createDiskBindingCache, } from "./diagnostic-binding.js";
+import { bindingStateLabel, composeBoundToCurrentDisk, createDiskBindingCache, touchCoverageGap, } from "./diagnostic-binding.js";
 import { getServersForFileWithConfig, getServerInitOverride } from "./config.js";
 import { getLanguageId } from "./language.js";
 import { LSP_SERVERS, enforceLspRootCeiling, hasProjectBoundaryMarker, isDirectLspCommandTemporarilyUnavailable, } from "./server.js";
@@ -230,13 +230,15 @@ function readTsserverSyncGraceMs() {
 }
 /**
  * Read the `PI_LENS_AUX_GRACE_MS` env override at call time (not module
- * load time) so tests can set it per-case. Controls how long auxiliary-role
- * promises (opengrep, ast-grep, zizmor, …) are waited after all primary-role
- * promises have settled in both getDiagnostics (raceToCompletion) and the
- * touchFile push wait. Default 500ms — conservative enough to include
- * auxiliaries that are nearly done while not blocking the primary result.
- * Returns undefined when the var is absent (caller falls back to the
- * raceToCompletion default of 500ms, keeping the two in sync).
+ * load time) so tests can set it per-case. Controls the CEILING on how long
+ * auxiliary-role promises (opengrep, ast-grep, zizmor, …) are waited after
+ * all primary-role promises have settled, in both getDiagnostics
+ * (raceToCompletion) and the touchFile push wait (#1458 S2 — the two lanes
+ * share the same declared-budget-capped-by-ceiling shape). Each auxiliary
+ * still gets only its OWN declared `aggregateWaitMs` up to this ceiling —
+ * this is not a flat per-touch wait. Returns undefined when the var is
+ * absent; each call site then supplies its own default ceiling (touchFile:
+ * 2000ms; getDiagnostics: 2000ms — see the `?? 2000` at each call site).
  */
 function readEnvAuxGraceMs() {
     const raw = process.env.PI_LENS_AUX_GRACE_MS;
@@ -636,10 +638,13 @@ export class LSPService {
             if (!key.startsWith(prefix))
                 continue;
             const ancestorKey = key.slice(prefix.length);
-            const relative = path.relative(ancestorKey, rootKey);
+            const pathApi = isWindowsPath(ancestorKey) || isWindowsPath(rootKey)
+                ? path.win32
+                : path;
+            const relative = pathApi.relative(ancestorKey, rootKey);
             if (relative === "" ||
                 relative.startsWith("..") ||
-                path.isAbsolute(relative)) {
+                pathApi.isAbsolute(relative)) {
                 continue;
             }
             if (!nearestAncestor || ancestorKey.length > nearestAncestor.length) {
@@ -1699,6 +1704,24 @@ export class LSPService {
             const notifySkippedServerIds = new Set(spawnedServerIds.filter((serverId) => this.shouldSkipNotify(filePath, content, clientScope, serverId)));
             const notifySkipped = spawned.length > 0 && notifySkippedServerIds.size === spawned.length;
             const diagnosticBaselines = new Map(spawned.map((entry) => [entry.client, entry.client.diagnosticsVersion]));
+            // #1458: read a late auxiliary publication BEFORE the ordinary resync
+            // clears its client cache. Carry it only when the publication's exact
+            // sent-content fingerprint matches this touch's content. A changed edit,
+            // version-less publication, or malformed binding fails closed and is not
+            // replayed. The fresh notify still runs below, so scanners continue toward
+            // a publication for this touch while the prior late result reaches the read.
+            const touchContentHash = this.hashContent(content);
+            const carriedAuxiliary = options.collectDiagnostics
+                ? spawned.flatMap((entry) => {
+                    if (entry.info.role !== "auxiliary")
+                        return [];
+                    const binding = entry.client.getDiagnosticBinding?.(filePath);
+                    if (binding?.contentHash !== touchContentHash)
+                        return [];
+                    const diags = entry.client.getDiagnostics(filePath);
+                    return diags.length > 0 ? [{ diags, binding }] : [];
+                })
+                : [];
             // #743: PER-SERVER notify-write deadlines. Each server's didOpen/didChange
             // write gets its OWN notifyWriteBudgetMs budget rather than one shared
             // deadline over a single Promise.all — otherwise one backpressured server
@@ -1827,7 +1850,7 @@ export class LSPService {
                 const sweepFirstTouch = new Map();
                 if (options.sweepIndexGate) {
                     for (const entry of spawned) {
-                        const strategy = getStrategy(entry.client.serverId);
+                        const strategy = getStrategy(entry.client.serverId, entry.client.getLaunchVariant?.());
                         if (strategy.workspaceIndexing) {
                             sweepFirstTouch.set(entry.client.serverId, options.sweepIndexGate.consumeFirstTouch(entry.client.serverId));
                         }
@@ -1848,7 +1871,7 @@ export class LSPService {
                 const silentCleanWarmupServers = new Set();
                 if (options.warmupOverride && (options.warmupAttempt ?? 1) <= 1) {
                     for (const entry of spawned) {
-                        const strategy = getStrategy(entry.client.serverId);
+                        const strategy = getStrategy(entry.client.serverId, entry.client.getLaunchVariant?.());
                         if (strategy.workspaceIndexing !== true)
                             continue;
                         try {
@@ -1877,7 +1900,8 @@ export class LSPService {
                 // slow aux (opengrep) can't override the per-edit cap. Resolves as soon
                 // as a server publishes; this is just its individual deadline. (#242)
                 const perServerTimeout = (serverId) => {
-                    const strategy = getStrategy(serverId);
+                    const launchVariant = spawned.find((entry) => entry.client.serverId === serverId)?.client.getLaunchVariant?.();
+                    const strategy = getStrategy(serverId, launchVariant);
                     let strategyWait = strategy.aggregateWaitMs;
                     // #645: a `workspaceIndexing` server (marksman) only needs the
                     // full budget for the FIRST same-sweep touch to it — every
@@ -1951,7 +1975,7 @@ export class LSPService {
                     clientScope === "primary" &&
                     spawned.length === 1 &&
                     spawned[0].client.serverId === "typescript" &&
-                    getStrategy(spawned[0].client.serverId).silentOnClean === true) {
+                    getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
                     try {
                         const snapshots = await this.getCapabilitySnapshots(filePath);
                         tsserverSyncEligible =
@@ -1979,7 +2003,17 @@ export class LSPService {
                 // The #707 tsserver sync race operates exclusively on single-server
                 // primary-scope touches (guarded by `clientScope === "primary" &&
                 // spawned.length === 1`), so there is NO interaction with this path.
+                // #1458 S4: also gated on `collectDiagnostics` — a non-collecting
+                // with-auxiliary touch has nothing to carry the aux wait's result
+                // INTO (its diagnostics are discarded either way), so paying up to
+                // `auxCeilingMs` of extra latency for it buys nothing. Both current
+                // callers (`getDiagnostics`'s with-auxiliary path and the cascade's
+                // collecting touch) already pass `collectDiagnostics: true`, so this
+                // is latent-today defense, not a behavior change — but a future
+                // non-collecting with-auxiliary caller must not silently inherit the
+                // full aux-grace cost for diagnostics it's about to throw away.
                 const hasTouchAuxiliaries = clientScope === "with-auxiliary" &&
+                    options.collectDiagnostics === true &&
                     spawned.some((e) => e.info.role === "auxiliary");
                 // Per-server wait promises (each already bounded by its own
                 // perServerTimeout — unchanged from before R8).
@@ -2017,49 +2051,100 @@ export class LSPService {
                     ? (() => {
                         // Primary waits: all non-auxiliary servers.
                         const primaryWaits = perServerWaits.filter((_, i) => spawned[i].info.role !== "auxiliary");
-                        // Aux waits: auxiliary servers (advisory).
+                        // Aux waits: auxiliary servers (advisory). `client` and the
+                        // pre-notify `diagnosticsVersion` baseline travel alongside the
+                        // promise so the outcome can be decided from EVIDENCE after the
+                        // race, not from how the raced promise settled (#1458 S1 — see
+                        // below).
                         const auxWaits = perServerWaits
                             .map((p, i) => spawned[i].info.role === "auxiliary"
-                            ? { promise: p, serverId: spawned[i].info.id }
+                            ? {
+                                promise: p,
+                                serverId: spawned[i].info.id,
+                                client: spawned[i].client,
+                                baseline: diagnosticBaselines.get(spawned[i].client),
+                            }
                             : null)
                             .filter((x) => x !== null);
-                        const auxGraceMs = readEnvAuxGraceMs() ?? 500;
-                        // After all primaries settle, give auxiliaries at most auxGraceMs.
-                        // Late aux results are dropped from the wait (advisory only — they
-                        // land in the client cache and surface on the next edit); aux servers
-                        // that did answer within the grace are included automatically since
+                        const auxCeilingMs = readEnvAuxGraceMs() ?? 2000;
+                        // After all primaries settle, give each auxiliary the smaller of
+                        // its declared wait budget and the global auxiliary ceiling. The
+                        // 2000ms default admits measured ~1.3s warm scanner runs without
+                        // making every edit pay opengrep's 3500ms cold-start allowance.
+                        // Late aux results are dropped from this wait. A later unchanged-
+                        // content read may carry a SHA-256-bound cache publication before its
+                        // resync clears the cache; changed or unknown content never replays.
+                        // Aux servers that answer within the grace are included automatically since
                         // their waitForDiagnostics already resolved. The cut-off server ids
                         // are logged in the latency metadata (lsp_touch_file phase, field
                         // `auxCutOffServerIds`).
                         return Promise.all(primaryWaits).then(async () => {
                             if (auxWaits.length === 0)
                                 return;
-                            const auxTimeout = new Promise((resolve) => {
-                                const t = setTimeout(() => resolve("timeout"), auxGraceMs);
-                                if (typeof t === "object" && "unref" in t)
-                                    t.unref?.();
+                            const auxWaitStartedAt = Date.now();
+                            const outcomes = await Promise.all(auxWaits.map(async (aux) => {
+                                const budgetMs = Math.min(timeoutFor(aux.serverId), auxCeilingMs);
+                                let timer;
+                                const timeout = new Promise((resolve) => {
+                                    timer = setTimeout(() => resolve(false), budgetMs);
+                                    if (typeof timer === "object" && "unref" in timer) {
+                                        timer.unref?.();
+                                    }
+                                });
+                                const raced = await Promise.race([
+                                    aux.promise.then(() => true),
+                                    timeout,
+                                ]);
+                                if (timer)
+                                    clearTimeout(timer);
+                                // #1458 S1: `waitForDiagnostics` RESOLVES on its own timeout
+                                // (client.ts) — it never rejects, and a silent scanner that
+                                // published nothing looks identical, promise-wise, to one
+                                // that answered. `raced === true` only means "the promise
+                                // settled before our timer fired"; it is not proof anything
+                                // was published. Decide the outcome from evidence instead:
+                                // did this aux's `diagnosticsVersion` advance past the
+                                // pre-notify baseline captured before the wait started?
+                                //   - raced === false            → "cut_off" (our timer won;
+                                //     the aux's own wait never got to answer for itself).
+                                //   - raced === true, no evidence → "silent" (the aux's own
+                                //     wait gave up within its budget with nothing to report —
+                                //     NOT the same as having answered).
+                                //   - raced === true, evidence   → "answered" (a fresh
+                                //     publication actually landed for this touch).
+                                const publishedEvidence = raced &&
+                                    Number.isFinite(aux.baseline) &&
+                                    aux.client.diagnosticsVersion > aux.baseline;
+                                const outcome = !raced
+                                    ? "cut_off"
+                                    : publishedEvidence
+                                        ? "answered"
+                                        : "silent";
+                                return {
+                                    serverId: aux.serverId,
+                                    outcome,
+                                    budgetMs,
+                                    elapsedMs: Date.now() - auxWaitStartedAt,
+                                    // #1458 S3: elapsed measured from BEFORE the primary wait
+                                    // (waitStartedAt), not just from auxWaitStartedAt — this is
+                                    // what lets a latency row validate the ~1.3s warm-scanner
+                                    // figure the 2000ms ceiling was set from; `elapsedMs` alone
+                                    // only covers the POST-primary aux phase.
+                                    elapsedSinceNotifyMs: Date.now() - waitStartedAt,
+                                };
+                            }));
+                            const unfinished = outcomes
+                                .filter((outcome) => outcome.outcome === "cut_off")
+                                .map((outcome) => outcome.serverId);
+                            if (unfinished.length > 0)
+                                auxCutOffServerIds = unfinished;
+                            logLatency({
+                                type: "phase",
+                                phase: "lsp_aux_wait_outcome",
+                                filePath: normalizedPath,
+                                durationMs: Date.now() - auxWaitStartedAt,
+                                metadata: { clientScope, outcomes },
                             });
-                            const auxAll = Promise.all(auxWaits.map((a) => a.promise)).then(() => "done");
-                            const outcome = await Promise.race([auxAll, auxTimeout]);
-                            if (outcome === "timeout") {
-                                // Record which auxiliaries did NOT finish in time.
-                                const unfinished = [];
-                                for (const a of auxWaits) {
-                                    let done = false;
-                                    // Check synchronously if already resolved by racing against
-                                    // a resolved promise.
-                                    await Promise.race([
-                                        a.promise.then(() => {
-                                            done = true;
-                                        }),
-                                        Promise.resolve(),
-                                    ]);
-                                    if (!done)
-                                        unfinished.push(a.serverId);
-                                }
-                                if (unfinished.length > 0)
-                                    auxCutOffServerIds = unfinished;
-                            }
                         });
                     })()
                     : Promise.all(perServerWaits).then(() => { });
@@ -2178,6 +2263,12 @@ export class LSPService {
                         durationMs: waitedMs,
                         metadata: {
                             source,
+                            // #1444: WHICH server(s) burned the budget — without this the
+                            // ~221/day timeout rows can't be attributed to a server at all.
+                            // `info.id` (not `client.serverId`) for the same reason the
+                            // degradation ledger above uses it: test doubles and lightweight
+                            // clients need not expose `serverId`.
+                            serverIds: spawned.map((e) => e.info.id),
                             clientScope,
                             diagnosticsMode,
                             timeoutMs,
@@ -2269,7 +2360,10 @@ export class LSPService {
             let collected = options.collectDiagnostics
                 ? tsserverSyncConfirmed !== undefined
                     ? mergeLspDiagnostics(tsserverSyncConfirmed)
-                    : mergeLspDiagnostics(spawned.flatMap((entry) => entry.client.getDiagnostics(filePath)))
+                    : mergeLspDiagnostics([
+                        ...spawned.flatMap((entry) => entry.client.getDiagnostics(filePath)),
+                        ...carriedAuxiliary.flatMap((entry) => entry.diags),
+                    ])
                 : undefined;
             // #1095 (P3-b): whether `collected` came from a tsserver sync confirm
             // (`tsserverSyncRequest`) rather than the publish cache. A sync-confirmed
@@ -2367,7 +2461,7 @@ export class LSPService {
                 !tsserverSyncEligible &&
                 clientScope === "primary" &&
                 spawned.length === 1 &&
-                getStrategy(spawned[0].client.serverId).silentOnClean === true) {
+                getStrategy(spawned[0].client.serverId, spawned[0].client.getLaunchVariant?.()).silentOnClean === true) {
                 try {
                     const snapshots = await this.getCapabilitySnapshots(filePath);
                     if (classifyCascadeWaitTier(this, filePath, snapshots) === "tier3-silent") {
@@ -2412,6 +2506,22 @@ export class LSPService {
             // findings that just hadn't arrived yet — it must not be trusted as a
             // confirmed answer.
             const inconclusive = notifyWriteTimedOut || diagnosticsTimedOut;
+            // #1470: an auxiliary whose push wait was CUT OFF by the aux grace timer
+            // (R8/#714) contributed exactly as much evidence about this file as one that
+            // went silent inside its own budget — none. A hung opengrep resolved
+            // `confirmation: "confirmed"` and read as confirmed-clean on the security
+            // lane. (The SILENT case still does, and is NOT addressed here: a scanner
+            // that settles inside its own budget without publishing also yields an
+            // unqualified confirmation. Same #533 class, same lane, different door —
+            // filed as #1493, deliberately untouched by this change.)
+            // This does NOT flip the touch to inconclusive: that would discard a
+            // primary answer that IS trustworthy (#533 honesty doctrine cuts both ways —
+            // overclaiming and underclaiming are both dishonest). Instead the confirmation
+            // is NARROWED: `"partial"`, naming the servers it does not speak for, so every
+            // consumer that treats confirmation as proof of coverage fails closed while
+            // the primary's findings still flow.
+            const unconfirmedServerIds = auxCutOffServerIds ?? [];
+            const coverageGap = unconfirmedServerIds.length > 0;
             // #667: a confirmed (non-inconclusive) diagnostics-mode touch is the
             // "actually warm" signal `ensureWarmForSweep` waits for — mark every
             // spawned server so a later sweep in this session sees the check as a
@@ -2422,11 +2532,27 @@ export class LSPService {
             // write stalled must still be eligible, so only servers whose OWN write
             // timed out are skipped here (rather than gating the whole loop on the
             // file-level `inconclusive`).
+            //
+            // #1470: same per-server reasoning for a CUT-OFF auxiliary. "Demonstrated
+            // ready" means this server answered for this file; an auxiliary our grace
+            // timer cut off demonstrably did not.
+            //
+            // NO TEST PINS THIS LINE, and that is a property of today's readers rather
+            // than a coverage gap: `ensureWarmForSweep` filters `role === "auxiliary"`
+            // out of its server list entirely, so no reader consumes an auxiliary's
+            // `demonstratedReady` mark and deleting this `continue` changes no observable
+            // behavior (verified by mutation — the LSP suite stays green). It stays
+            // because the mark's meaning is "this server answered", and the moment any
+            // reader stops filtering auxiliaries out, marking a cut-off scanner warm
+            // would let it skip a warm-up it never earned.
             const notifyTimedOutServerIds = new Set(notifyWriteTimedOutServerIds);
+            const cutOffServerIds = new Set(unconfirmedServerIds);
             if (diagnosticsMode !== "none" && !diagnosticsTimedOut) {
                 for (const entry of spawned) {
                     if (notifyTimedOutServerIds.has(entry.info.id))
                         continue;
+                    if (cutOffServerIds.has(entry.info.id))
+                        continue;
                     const key = await this.demonstratedReadyKeyFor(entry.info, filePath);
                     if (key)
                         this.markDemonstratedReadyKey(key);
@@ -2441,7 +2567,14 @@ export class LSPService {
             // empty `collected` must never erase a previously-confirmed non-empty
             // record (that's the #570 bug — a timeout silently reporting as clean
             // and wiping out known-good diagnostic state).
-            if (collected !== undefined && !inconclusive) {
+            // #1470: a PARTIAL touch is the same hazard wearing a different flag. Its
+            // merged array is missing whatever the cut-off auxiliary would have said, so
+            // priming the cache with it would let `actionable-warnings`' hash-guarded
+            // read replay a partially-covered result as an authoritative observation —
+            // and an empty one would DELETE a previously-confirmed record on the strength
+            // of a scanner that never answered. Skip the prime; the next read pays a real
+            // round trip instead of trusting an incomplete one.
+            if (collected !== undefined && !inconclusive && !coverageGap) {
                 const normalizedKey = normalizeMapKey(filePath);
                 if (collected.length > 0) {
                     this.lastKnownDiagnostics.set(normalizedKey, collected);
@@ -2465,6 +2598,14 @@ export class LSPService {
             if (collected !== undefined && inconclusive) {
                 result.inconclusive = true;
             }
+            else if (collected !== undefined && coverageGap) {
+                // #1470: narrowed, not collapsed. The primary's findings ride along in
+                // `.diags` exactly as before; what changes is that the touch now states
+                // which servers it does not speak for, so no consumer can read this as a
+                // full clean bill of health.
+                result.confirmation = "partial";
+                result.unconfirmedServerIds = [...unconfirmedServerIds];
+            }
             else if (collected !== undefined) {
                 // Preserve the lower-level affirmative result across consumers. In
                 // particular, the silent-clean gates above clear diagnosticsTimedOut only
@@ -2488,7 +2629,10 @@ export class LSPService {
                     // Optional-chain so a client without the getter (test doubles, a
                     // partially-mocked client) yields "unknown" rather than throwing —
                     // unknown preserves pre-#1095 behavior for that contributor.
-                    spawned.map((entry) => entry.client.getDiagnosticBinding?.(filePath)));
+                    [
+                        ...spawned.map((entry) => entry.client.getDiagnosticBinding?.(filePath)),
+                        ...carriedAuxiliary.map((entry) => entry.binding),
+                    ]);
                 result.binding = binding;
             }
             // The recent-touches entries are recorded per server inside the notify-write
@@ -2527,6 +2671,13 @@ export class LSPService {
                     }),
                     diagnosticsTimedOut,
                     inconclusive,
+                    // #1470: the touch's own honesty verdict, so a `cut_off` row in
+                    // `lsp_aux_wait_outcome` can be joined to the touch that produced it and
+                    // shown NOT to have claimed confirmation for that server's coverage.
+                    // Absent for a non-collecting touch, which claims nothing either way.
+                    ...(result.confirmation !== undefined && {
+                        confirmation: result.confirmation,
+                    }),
                     // R8 (#714): server ids of auxiliaries whose push wait was cut off by
                     // the aux grace window (primary settled clean + aux timed out in grace).
                     // Absent when no aux was cut off. These servers' diagnostics are
@@ -2624,7 +2775,8 @@ export class LSPService {
         }
         const clientWaits = spawned.map(async (entry) => {
             const waitStart = Date.now();
-            const strategy = getStrategy(entry.info.id);
+            const launchVariant = entry.client.getLaunchVariant?.();
+            const strategy = getStrategy(entry.info.id, launchVariant);
             await entry.client.waitForDiagnostics(filePath, strategy.aggregateWaitMs);
             let diagnostics = entry.client.getDiagnostics(filePath);
             const firstWaitMs = Date.now() - waitStart;
@@ -2636,6 +2788,7 @@ export class LSPService {
             }
             return {
                 serverId: entry.info.id,
+                launchVariant,
                 waitMs: Date.now() - waitStart,
                 diagnosticCount: diagnostics.length,
                 diagnostics,
@@ -2644,25 +2797,48 @@ export class LSPService {
         // Document mode: 0ms grace — return as soon as any client has results.
         // Full mode: 400ms grace — wait a bit for other clients to catch up.
         const graceMs = diagnosticsMode === "document" ? 0 : EARLY_UNBLOCK_GRACE_MS;
-        // R8 (#714): per-promise role descriptors so raceToCompletion can apply
-        // a bounded aux grace once all primary-role promises have settled.
-        // Servers with role:"auxiliary" (opengrep, ast-grep, zizmor, …) get at
-        // most PI_LENS_AUX_GRACE_MS (default 500ms) after the primary settles;
-        // late arrivals are dropped (advisory only — they land in the client
+        // R8 (#714) / #1458 S2: per-promise role descriptors so raceToCompletion
+        // can apply a bounded aux grace once all primary-role promises have
+        // settled. Servers with role:"auxiliary" (opengrep, ast-grep, zizmor, …)
+        // get their OWN declared `aggregateWaitMs` budget after the primary
+        // settles, capped by the PI_LENS_AUX_GRACE_MS global ceiling (default
+        // 2000ms) — the same "declared budget, capped by a ceiling" shape
+        // `touchFile`'s with-auxiliary push wait uses, so this lane can no longer
+        // starve a scanner whose measured warm run (e.g. opengrep ~1.3s) is
+        // shorter than the ceiling but longer than a flat short grace. Late
+        // arrivals are still dropped (advisory only — they land in the client
         // cache and surface on the next edit). Primary-only callers have no
         // auxiliary descriptors, so this path is never entered and there is
         // zero behavior change for the single-server hot path.
-        const diagDescriptors = spawned.map((entry) => ({
-            role: entry.info.role === "auxiliary" ? "auxiliary" : "primary",
-        }));
+        const diagDescriptors = spawned.map((entry) => {
+            if (entry.info.role !== "auxiliary")
+                return { role: "primary" };
+            const strategy = getStrategy(entry.info.id, entry.client.getLaunchVariant?.());
+            // Deleting this `budgetMs` fails no end-to-end test, and that is
+            // expected rather than a coverage gap: every promise in `clientWaits`
+            // already self-bounds at this same `strategy.aggregateWaitMs`, so an
+            // auxiliary cuts itself off at its declared budget whether or not the
+            // shared grace timer also knows about it. The descriptor is what keeps
+            // the two agreeing — it is the mitigation for the over-granting
+            // `raceToCompletion` documents, and it starts mattering the moment a
+            // promise here stops self-bounding. The narrowing itself is pinned in
+            // tests/clients/lsp/aggregation.test.ts, which can build the
+            // non-self-bounded promises this path cannot.
+            return { role: "auxiliary", budgetMs: strategy.aggregateWaitMs };
+        });
         // Result-aware racing: trigger early-unblock when any client has results,
         // OR when a seedFirstPush server returns (its first push is authoritative
         // even when empty — waiting longer yields nothing more).
-        const perServer = await raceToCompletion(clientWaits, (results) => results.some((r) => r.diagnosticCount > 0 || getStrategy(r.serverId).seedFirstPush), {
-            timeoutMs: Math.max(...spawned.map((entry) => getStrategy(entry.info.id).aggregateWaitMs)),
+        const perServer = await raceToCompletion(clientWaits, (results) => results.some((r) => r.diagnosticCount > 0 ||
+            getStrategy(r.serverId, r.launchVariant).seedFirstPush), {
+            timeoutMs: Math.max(...spawned.map((entry) => getStrategy(entry.info.id, entry.client.getLaunchVariant?.())
+                .aggregateWaitMs)),
             graceMs,
             descriptors: diagDescriptors,
-            auxGraceMs: readEnvAuxGraceMs(),
+            // #1458 S2: ceiling, not a flat wait — each auxiliary's own
+            // budgetMs (above) determines the actual per-touch grace up to
+            // this cap. Matches touchFile's `readEnvAuxGraceMs() ?? 2000`.
+            auxGraceMs: readEnvAuxGraceMs() ?? 2000,
         });
         // Fill in any slots that timed out before producing results.
         const earlyUnblockedCount = spawned.length - perServer.length;
@@ -2670,7 +2846,8 @@ export class LSPService {
             const found = perServer.find((r) => r.serverId === entry.info.id);
             return (found ?? {
                 serverId: entry.info.id,
-                waitMs: getStrategy(entry.info.id).aggregateWaitMs,
+                launchVariant: entry.client.getLaunchVariant?.(),
+                waitMs: getStrategy(entry.info.id, entry.client.getLaunchVariant?.()).aggregateWaitMs,
                 diagnosticCount: 0,
                 diagnostics: [],
             });
@@ -3745,7 +3922,17 @@ export class LSPService {
                 // answer, so `available` implies confirmed) — wrap it as `{ diags }`;
                 // the incumbent branch already returns the wrapper.
                 const touchResult = attached?.available
-                    ? { diags: attached.response.diagnostics }
+                    ? {
+                        diags: attached.response.diagnostics,
+                        // #1470: the incumbent's coverage gap crosses the socket as an
+                        // explicit DTO field, so carry it onto the wrapper the sweep
+                        // reads. Dropping it here would let a partially covered
+                        // incumbent answer be persisted as a confirmed sweep result —
+                        // the same false clean this change closes on the local route.
+                        ...(attached.response.unconfirmedServerIds !== undefined && {
+                            unconfirmedServerIds: attached.response.unconfirmedServerIds,
+                        }),
+                    }
                     : await withDeadline(this.touchFile(filePath, content, {
                         diagnostics: "document",
                         collectDiagnostics: true,
@@ -3767,7 +3954,18 @@ export class LSPService {
                 // `perFileMs` deadline, which only catches a touch that never returned at
                 // all within budget. Either one means the result wasn't confirmed.
                 const inconclusive = touchResult?.inconclusive === true;
-                const timedOut = touchResult === undefined || inconclusive;
+                // #1470: a cut-off auxiliary is the THIRD reason this result is not a
+                // confirmed observation, and it is deliberately not `inconclusive`. The
+                // record loop below persists every `!timedOut` result into the workspace
+                // cache, so reading `inconclusive` alone caches a partially covered
+                // answer as clean and replays it on every later sweep. Today the only
+                // route that can reach this branch with a gap is the warm-attach
+                // incumbent, whose touch runs `clientScope: "with-auxiliary"`; the
+                // sweep's own local touch uses `clientScope: "all"`, which never arms
+                // the aux grace timer at all. Both are gated here so a future scope
+                // change cannot reopen the hole silently.
+                const coverageGap = touchCoverageGap(touchResult).length > 0;
+                const timedOut = touchResult === undefined || inconclusive || coverageGap;
                 if (timedOut)
                     timedOutFiles += 1;
                 // #1104 (shape 5 — AGENTS.md): the touch's content binding is an