@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/diagnostic-line-freshness.js

@@ -0,0 +1,298 @@
+/**
+ * Past-EOF validity gate for cited diagnostic line numbers (#1641).
+ *
+ * A live session served diagnostics at lines 407-410 of a file that was 402
+ * lines on disk and UNMODIFIED — the LSP's in-memory document had drifted
+ * longer than disk without any file write happening (no didChange lost, just
+ * an in-memory buffer that grew past what the file actually contains). That
+ * makes this a DIFFERENT invariant than #1622/#1627's freshness gate: those
+ * compare a cited file's MTIME against a scan timestamp, which says nothing
+ * when the file was never touched on disk at all. The cheap, orthogonal check
+ * available here is structural: a diagnostic whose start line exceeds the
+ * file's CURRENT line count cannot possibly be describing current content,
+ * regardless of what any timestamp says.
+ *
+ * CONTRACT:
+ *   - A diagnostic citing a line beyond the file's current line count is
+ *     DEMOTED (`stale: true`), never dropped — the underlying issue may well
+ *     still be real, just at a coordinate this gate can no longer vouch for.
+ *   - RE-ARMS, never latches: the verdict is recomputed from the gate's own
+ *     inputs (current mtime, current line count) on every call, so a
+ *     TRANSIENT shrink (truncate-then-write, a formatter pass, a checkout)
+ *     that later restores the line un-demotes on its own next read. A
+ *     persisted `stale: true` a caller stores between calls is a cache of the
+ *     last-derived verdict, never an independent source of truth that
+ *     overrides the next derivation — the #1633-V1 lesson: derive, don't latch.
+ *   - Fail open: a file that cannot be stat'ed/read, or exceeds the size gate,
+ *     yields no verdict at all (every diagnostic passes through unchanged).
+ *     An unreadable/oversized file is not evidence of anything; demoting on
+ *     it would manufacture false staleness.
+ *   - The line count matches the LSP's own addressing, not `wc -l`: a
+ *     document with N newline characters has N+1 ADDRESSABLE lines (the
+ *     line after the final `\n`, or the single line of an empty document,
+ *     is a real position a server can anchor a diagnostic to — e.g. TS1005
+ *     "'}' expected" at EOF). `WidgetDiagnostic.line` is always
+ *     `range.start.line + 1` from that same addressing, so the gate must
+ *     use it too or every trailing-newline file demotes its own valid EOF
+ *     diagnostics.
+ *   - Cost discipline: one `statSync` per served file; the file's newlines
+ *     are counted in bounded chunks via a raw fd read (never a full
+ *     `readFileSync` — no whole-file string materialization, no per-render
+ *     re-read of unchanged content), gated by a byte-size cap matching
+ *     `captureReadContentBinding`'s precedent (`read-guard.ts`). The count is
+ *     memoized in a small SHARED cache (module-scoped, bounded, evicted FIFO
+ *     past a cap), keyed on BOTH mtime AND size (review round V1) — mtime
+ *     ALONE is not a reliable cache key on hosts where its resolution is
+ *     coarser than back-to-back writes: a truncate-then-write, a formatter
+ *     write-back, or pi-lens's own auto-format immediately followed by the
+ *     agent's write can land two DIFFERENT contents on the identical
+ *     `mtimeMs`, and a mtime-only cache serves the first content's count for
+ *     the second — measured live at 207/300 shrink/restore cycles. Requiring
+ *     both to match narrows a same-tick collision to same-mtime-AND-same-size
+ *     (which a shrink/restore cycle never produces, since the whole point is
+ *     the size changed). A changed file is always recounted. Tests can still
+ *     inject an isolated {@link LineCountCache} via {@link createLineCountCache}
+ *     to avoid cross-test bleed.
+ *   - On a demotion EDGE (a diagnostic that was not already flagged past-EOF
+ *     and now is), best-effort trigger a document resync (didClose/didOpen or
+ *     a full-sync didChange) so the desync HEALS instead of re-serving the
+ *     same stale verdict next time (#1631's resync-before-revalidate rule).
+ *     Resync is fire-and-forget: a failure here must never block or fail the
+ *     render path that discovered the drift. Already-demoted entries and the
+ *     healing direction never re-trigger a resync — only the rising edge does.
+ */
+import * as fs from "node:fs";
+import { logLatency } from "./latency-logger.js";
+import { toProjectRelativePath } from "./path-utils.js";
+import { STALE_LINE_MARKER } from "./stale-marker.js";
+/** Marker rendered in place of a demoted diagnostic's now-untrustworthy line.
+ * Shares the base `STALE_LINE_MARKER` vocabulary with sibling freshness
+ * gates (#1622/#1633) and adds this gate's own specific reason as a suffix. */
+export const PAST_EOF_STALE_MARKER = `${STALE_LINE_MARKER} — line past EOF`;
+/** How many demoted cited lines a single record names before it stops. */
+const MAX_LOGGED_PAST_EOF_LINES = 3;
+/** Byte-size gate matching `captureReadContentBinding`'s precedent
+ * (`clients/read-guard.ts`'s `READ_BINDING_MAX_BYTES`) — a hot render/serve
+ * path must never pay to scan an unbounded file. */
+const MAX_GATE_BYTES = 4 * 1024 * 1024;
+/** Chunk size for the bounded newline scan — small enough to keep one read's
+ * memory footprint negligible, large enough that a multi-MB file finishes in
+ * single-digit reads rather than thousands. */
+const NEWLINE_SCAN_CHUNK_BYTES = 64 * 1024;
+const NEWLINE_BYTE = 0x0a;
+/** Test-only isolation seam. Production code uses the shared default cache. */
+export function createLineCountCache() {
+    return new Map();
+}
+// Shared across calls/render passes so N files touched once per session cost
+// N recounts total, not N per render — the actual fix for the cost this gate
+// exists to control. Still cannot go stale: every read re-stats first and a
+// mismatched mtime always recomputes (see the module doc comment). Bounded
+// via FIFO eviction (mirrors `READ_GUARD_MAX_FILES`'s precedent) so a long
+// session's file count cannot grow this without limit.
+const MAX_SHARED_CACHE_ENTRIES = 512;
+const sharedLineCountCache = new Map();
+function rememberInSharedCache(cache, filePath, entry) {
+    if (cache === sharedLineCountCache &&
+        cache.size >= MAX_SHARED_CACHE_ENTRIES &&
+        !cache.has(filePath)) {
+        const oldest = cache.keys().next().value;
+        if (oldest !== undefined)
+            cache.delete(oldest);
+    }
+    cache.set(filePath, entry);
+}
+/** Test-only: drop the shared memo between test files/cases. */
+export function _resetSharedLineCountCacheForTests() {
+    sharedLineCountCache.clear();
+}
+/**
+ * Test-only: seed the shared memo with a fabricated entry, deterministically
+ * proving a cache HIT (and that the default cache used by callers with no
+ * explicit `lineCountCache` is genuinely shared across calls) without relying
+ * on a real write's mtime round-tripping through `fs.utimesSync` at full
+ * precision — a platform-specific hazard on its own, unrelated to what such a
+ * test is actually verifying.
+ */
+export function _seedSharedLineCountCacheForTests(filePath, entry) {
+    sharedLineCountCache.set(filePath, entry);
+}
+/**
+ * Count newline bytes in `filePath` via bounded raw reads — never a full
+ * `readFileSync`/UTF-8 decode of the whole file. `0x0A` (LF) never appears as
+ * a continuation byte in UTF-8, so counting it at the byte level is exact
+ * regardless of encoding, and multi-byte characters spanning a chunk boundary
+ * cannot produce a false match (a continuation byte's high bits can never
+ * equal `0x0A`).
+ */
+function countNewlinesChunked(filePath, sizeBytes) {
+    const fd = fs.openSync(filePath, "r");
+    try {
+        const buffer = Buffer.allocUnsafe(Math.min(NEWLINE_SCAN_CHUNK_BYTES, sizeBytes) || 1);
+        let newlineCount = 0;
+        let position = 0;
+        while (position < sizeBytes) {
+            const bytesRead = fs.readSync(fd, buffer, 0, buffer.length, position);
+            if (bytesRead <= 0)
+                break;
+            for (let i = 0; i < bytesRead; i++) {
+                if (buffer[i] === NEWLINE_BYTE)
+                    newlineCount++;
+            }
+            position += bytesRead;
+        }
+        return newlineCount;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * LSP-addressable line count for `filePath`: newline count + 1, matching
+ * `range.start.line + 1` (a document with zero newlines still has one
+ * addressable line — position 0,0 — and a trailing `\n` adds one more,
+ * empty, addressable line after it). Memoized in `cache` (the shared default
+ * unless a caller injects its own) and invalidated by mtime AND size (V1 —
+ * mtime alone is not a reliable cache key on hosts where its resolution is
+ * coarser than back-to-back writes). Returns `undefined` when the file
+ * cannot be stat'ed, is zero bytes, exceeds the byte-size gate, or
+ * cannot be read (deleted, unreadable, permissions, oversized) — callers MUST
+ * treat `undefined` as "no verdict", not as "zero lines" (the empty-result-
+ * must-distinguish-clean-from-errored screen).
+ */
+export function getCachedLineCount(filePath, cache = sharedLineCountCache) {
+    let stat;
+    try {
+        stat = fs.statSync(filePath);
+    }
+    catch {
+        return undefined;
+    }
+    // A zero-byte stat can be a truncate-then-write window. It is not evidence
+    // that the file has one addressable line, so fail open like an unreadable
+    // file rather than manufacturing a verdict from the empty read.
+    if (stat.size === 0)
+        return undefined;
+    const cached = cache.get(filePath);
+    if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) {
+        return cached.lineCount;
+    }
+    if (stat.size > MAX_GATE_BYTES)
+        return undefined;
+    let newlineCount;
+    try {
+        newlineCount = countNewlinesChunked(filePath, stat.size);
+    }
+    catch {
+        return undefined;
+    }
+    const lineCount = newlineCount + 1;
+    rememberInSharedCache(cache, filePath, {
+        mtimeMs: stat.mtimeMs,
+        size: stat.size,
+        lineCount,
+    });
+    return lineCount;
+}
+/**
+ * Recompute the past-EOF verdict for every diagnostic in `diagnostics`
+ * against `filePath`'s CURRENT line count. Sets `stale: true` on a match and
+ * `stale: false` when a previously-past-EOF line is back in bounds (a
+ * transient shrink healed) — the verdict is always derived fresh, never
+ * latched. Pure apart from the cached stat/read in {@link getCachedLineCount}
+ * and the bounded `logLatency`/`resync` calls, which fire only on a RISING
+ * edge (a diagnostic that was not already flagged and now is) so an
+ * unchanged persistent demotion doesn't re-log or re-resync on every render.
+ * Never throws, never mutates the input array.
+ */
+export function demotePastEofDiagnostics(args) {
+    const { diagnostics } = args;
+    if (diagnostics.length === 0) {
+        return { diagnostics: [], demotedCount: 0 };
+    }
+    const lineCount = getCachedLineCount(args.filePath, args.lineCountCache ?? sharedLineCountCache);
+    if (lineCount === undefined) {
+        // Fail open: no verdict available for this file right now. Leave
+        // whatever `stale` value each entry already carries untouched — this
+        // gate has nothing to say either direction.
+        return { diagnostics: [...diagnostics], demotedCount: 0 };
+    }
+    const risingEdgeLines = [];
+    const out = diagnostics.map((d) => {
+        // Another gate's demotion is not this gate's to heal (#1631 drift
+        // entries have in-bounds lines; re-deriving here would clear them).
+        if (d.stale && d.staleReason !== undefined && d.staleReason !== "past-eof")
+            return d;
+        const isPastEof = typeof d.line === "number" && d.line > lineCount;
+        if (isPastEof === !!d.stale)
+            return d; // no transition either direction
+        if (isPastEof)
+            risingEdgeLines.push(d.line);
+        return { ...d, stale: isPastEof, staleReason: isPastEof ? "past-eof" : undefined };
+    });
+    if (risingEdgeLines.length === 0) {
+        return { diagnostics: out, demotedCount: 0 };
+    }
+    let sizeBytes;
+    try {
+        sizeBytes = fs.statSync(args.filePath).size;
+    }
+    catch {
+        sizeBytes = 0;
+    }
+    logLatency({
+        type: "phase",
+        phase: "diagnostic_past_eof",
+        filePath: args.cwd,
+        durationMs: 0,
+        metadata: {
+            store: args.store,
+            file: toProjectRelativePath(args.filePath, args.cwd),
+            sizeBytes,
+            actualLineCount: lineCount,
+            demotedCount: risingEdgeLines.length,
+            sampleCitedLines: risingEdgeLines.slice(0, MAX_LOGGED_PAST_EOF_LINES),
+        },
+    });
+    if (args.resync) {
+        try {
+            args.resync(args.filePath);
+        }
+        catch {
+            // Best-effort — a resync failure must never fail the render path.
+        }
+    }
+    return { diagnostics: out, demotedCount: risingEdgeLines.length };
+}
+/**
+ * Default resync trigger (#1641 criterion 2): re-open the file with its
+ * CURRENT disk content so the LSP's in-memory document is replaced rather
+ * than left to re-publish the same divergent diagnostics next time
+ * (`LSPService.openFile` sends a full-sync didChange, or a didClose/didOpen
+ * pair for servers that only re-scan on a fresh open — see
+ * `handleNotifyOpen`'s `reopenOnResync` branch). Dynamic import (mirrors
+ * `clients/module-report-lsp.ts`) so this module — used from widget-state.ts
+ * and tools/lens-diagnostics.ts — never statically depends on `clients/lsp`,
+ * which itself imports widget-state.ts.
+ *
+ * Fire-and-forget by design: the caller is a synchronous render path and must
+ * not block on (or fail because of) a resync. No LSP service, no client for
+ * this file's language, or a transient read/spawn failure all degrade to a
+ * silent no-op — the next successful touch/dispatch resyncs anyway.
+ */
+export function resyncDocumentOnPastEof(filePath) {
+    void (async () => {
+        try {
+            const [{ getLSPService }, content] = await Promise.all([
+                import("./lsp/index.js"),
+                fs.promises.readFile(filePath, "utf-8"),
+            ]);
+            await getLSPService().openFile(filePath, content, {
+                preserveDiagnostics: false,
+            });
+        }
+        catch {
+            // Best-effort heal only.
+        }
+    })();
+}

package/node_modules/pi-lens/dist/clients/diagnostics-publish.js

@@ -61,7 +61,7 @@
  */
 import { logBusEvent } from "./bus-events-logger.js";
 import { normalizeFilePath } from "./path-utils.js";
-import { createLiveBusEmitter, recordStaleBusFailure, } from "./live-bus-emitter.js";
+import { createLiveBusEmitter, recordStaleBusFailure, resolveLiveBusEmitter, } from "./live-bus-emitter.js";
 import { isBusPublishEnabled } from "./bus-publish.js";
 export const BUS_DIAGNOSTICS_EVENT = "pilens:diagnostics";
 export const BUS_DIAGNOSTICS_VERSION = 1;
@@ -149,8 +149,13 @@ export function publishDiagnostics(args) {
         }
         return;
     }
-    const busEmit = liveEmitter.get();
-    if (!busEmit) {
+    const resolution = resolveLiveBusEmitter(liveEmitter, () => ({
+        event: BUS_DIAGNOSTICS_EVENT,
+        cwd: normalizeFilePath(args.cwd),
+    }));
+    if (resolution.outcome === "stale-session")
+        return;
+    if (resolution.outcome === "unwired") {
         if (!hasLoggedUnwired) {
             hasLoggedUnwired = true;
             logBusEvent({
@@ -161,6 +166,7 @@ export function publishDiagnostics(args) {
         }
         return;
     }
+    const busEmit = resolution.emit;
     try {
         const fileEntries = args.files.map((f) => {
             const normPath = normalizeFilePath(f.path);
@@ -204,6 +210,7 @@ export function publishDiagnostics(args) {
             outcome: "emit_failed",
             cwd: normalizeFilePath(args.cwd),
             error: String(err),
+            ctxSource: resolution.ctxSource,
         });
         if (!hasLoggedFailure) {
             hasLoggedFailure = true;

package/node_modules/pi-lens/dist/clients/dispatch/dispatcher.js

@@ -22,13 +22,14 @@ import { detectFileRole } from "../file-role.js";
 import { isTestFile } from "../file-utils.js";
 import { getPrimaryDispatchGroup } from "../language-policy.js";
 import { resolveLanguageRootForFile } from "../language-profile.js";
-import { logLatency } from "../latency-logger.js";
+import { logLatency, phaseFinished, phaseStarted } from "../latency-logger.js";
 import { isSpawnableCommand } from "../installer/index.js";
 import { normalizeMapKey } from "../path-utils.js";
 import { loadPiLensProjectConfig } from "../project-lens-config.js";
 import { RUNTIME_CONFIG, getRunnerTimeoutFloorMs } from "../runtime-config.js";
 import { safeSpawnAsync } from "../safe-spawn.js";
 import { classifyDiagnostic } from "./diagnostic-taxonomy.js";
+import { classifyProbeFailure, logAvailabilityDecision, startHostStallSampler, transientRetryDelayMs, } from "./runners/utils/availability-policy.js";
 import { applyDispositions } from "../diagnostic-dispositions.js";
 import { applyInlineSuppressions } from "./inline-suppressions.js";
 import { getToolPlan } from "./plan.js";
@@ -76,12 +77,49 @@ export function normalizeCacheKey(cmd) {
     const normalized = cmd.replace(/\.(cmd|exe)$/i, "").toLowerCase();
     return `session.toolCache.${normalized}`;
 }
-async function checkToolAvailability(command, facts) {
+/** Probe budget for the generic `hasTool` availability check, ms. */
+const TOOL_PROBE_TIMEOUT_MS = 5000;
+/**
+ * Session fact holding the epoch ms after which a TRANSIENT verdict for a
+ * command may be re-probed. Kept beside the boolean fact so both share the
+ * session's lifetime — no second global to reset (#1476).
+ */
+function transientRetryKey(command) {
+    return `${normalizeCacheKey(command)}.retryAt`;
+}
+/**
+ * Consecutive transient verdicts for a command, so the cooldown ESCALATES the
+ * way the policy documents (30 s, 60 s, 120 s … capped at 5 min) instead of
+ * sitting flat at 30 s.
+ *
+ * This is the highest-traffic availability consumer in the product. A flat
+ * cooldown here means a permanently sick host is re-probed every 30 s per
+ * command for the whole session — ten times the storm the policy claims to
+ * bound, and the one place the bound matters most. `createAvailabilityChecker`
+ * tracks the same counter; this keeps the two seams telling one story.
+ */
+function transientAttemptsKey(command) {
+    return `${normalizeCacheKey(command)}.transientAttempts`;
+}
+/**
+ * Is `command` usable right now? Cached per session.
+ *
+ * Latch policy (#1467/#1476): a `false` from a genuine absence is durable and
+ * is remembered for the session. A `false` from a TIMED-OUT probe is not — this
+ * is the highest-traffic availability consumer in the codebase, and caching a
+ * host stall here silently disabled a healthy tool for every later dispatch in
+ * the session. A transient verdict instead holds only for a bounded cooldown,
+ * which also stops a sick host from being re-probed on every dispatch.
+ */
+export async function checkToolAvailability(command, facts) {
     const key = normalizeCacheKey(command);
     const cached = facts.getSessionFact(key);
     if (cached !== undefined) {
         return cached;
     }
+    const retryAt = facts.getSessionFact(transientRetryKey(command));
+    if (retryAt !== undefined && Date.now() < retryAt)
+        return false;
     // A command that isn't even on disk can't pass a --version probe; the ~μs
     // stat/PATH walk saves a guaranteed-to-fail spawn round-trip per cold tool.
     if (!(await isSpawnableCommand(command))) {
@@ -89,12 +127,70 @@ async function checkToolAvailability(command, facts) {
         return false;
     }
     try {
-        const result = await safeSpawnAsync(command, ["--version"], {
-            timeout: 5000,
+        // The budget is enforced by a HOST-side timer, so measure the loop stall
+        // that overlapped the window and let the shared classifier read it.
+        const sampler = startHostStallSampler();
+        const startedAt = Date.now();
+        let result;
+        let hostStallMs;
+        try {
+            result = await safeSpawnAsync(command, ["--version"], {
+                timeout: TOOL_PROBE_TIMEOUT_MS,
+            });
+        }
+        finally {
+            hostStallMs = sampler.stop();
+        }
+        const elapsedMs = Date.now() - startedAt;
+        if (result.status === 0) {
+            facts.setSessionFact(key, true);
+            // The tool answered: retire the cooldown facts rather than leaving a
+            // stale retry deadline behind a `true`.
+            facts.setSessionFact(transientRetryKey(command), 0);
+            facts.setSessionFact(transientAttemptsKey(command), 0);
+            logAvailabilityDecision({
+                tool: command,
+                verdict: "available",
+                outcome: "success",
+                cause: "ok",
+                elapsedMs,
+                latched: true,
+                hostStallMs,
+                budgetMs: TOOL_PROBE_TIMEOUT_MS,
+            });
+            return true;
+        }
+        // `missing` for anything unclassified preserves the pre-#1476 meaning of
+        // a non-zero exit: durable, cached for the session.
+        const { outcome, cause, evidence } = classifyProbeFailure(result, {
+            hostStallMs,
+            unclassifiedFailureOutcome: "missing",
+        });
+        let retryAfterMs;
+        if (outcome === "transient") {
+            const attempts = (facts.getSessionFact(transientAttemptsKey(command)) ?? 0) + 1;
+            facts.setSessionFact(transientAttemptsKey(command), attempts);
+            retryAfterMs = transientRetryDelayMs(attempts, cause);
+            facts.setSessionFact(transientRetryKey(command), Date.now() + retryAfterMs);
+        }
+        else {
+            facts.setSessionFact(key, false);
+            facts.setSessionFact(transientAttemptsKey(command), 0);
+        }
+        logAvailabilityDecision({
+            tool: command,
+            verdict: "unavailable",
+            outcome,
+            cause,
+            elapsedMs,
+            latched: outcome !== "transient",
+            hostStallMs,
+            ...(retryAfterMs !== undefined && { retryAfterMs }),
+            budgetMs: TOOL_PROBE_TIMEOUT_MS,
+            classifiedBy: "probe",
+            evidence,
         });
-        const available = result.status === 0;
-        facts.setSessionFact(key, available);
-        return available;
+        return false;
     }
     catch {
         facts.setSessionFact(key, false);
@@ -128,7 +224,10 @@ export function createDispatchContext(filePath, cwd, pi, facts, blockingOnly, mo
 /** Authoritative workspace root; `cwd` may be a nested language root. */
 projectRoot, 
 /** Ordered per-file pipeline token, when this is a post-write dispatch. */
-writeIndex) {
+writeIndex, 
+/** Runtime telemetry identity, when known (#1448) — threaded to the
+ * worklog append; see DispatchContext.telemetryModel's doc. */
+telemetryModel, telemetryProvider) {
     const absoluteFilePath = resolveRunnerPath(cwd, filePath);
     const normalizedProjectRoot = normalizeMapKey(path.resolve(projectRoot ?? cwd));
     const normalizedCwd = normalizeMapKey(resolveLanguageRootForFile(absoluteFilePath, cwd));
@@ -150,6 +249,8 @@ writeIndex) {
         blockingOnly,
         modifiedRanges,
         writeIndex,
+        telemetryModel,
+        telemetryProvider,
         async hasTool(command) {
             return checkToolAvailability(command, facts);
         },
@@ -307,6 +408,38 @@ function buildCoverageNotice(ctx, runnerLatencies) {
     const relevant = runnerLatencies.filter((r) => primary.runnerIds.includes(r.runnerId));
     if (relevant.length === 0)
         return undefined;
+    // #1867 catalog shape 4: this is correlation, not classification. The LSP
+    // touch already decided which scanner publications were absent for these
+    // bytes; the runner and latency assembly only preserve that exact set.
+    const unconfirmedServerIds = [
+        ...new Set(relevant.flatMap((r) => r.unconfirmedServerIds ?? [])),
+    ];
+    if (unconfirmedServerIds.length > 0) {
+        // The marker describes this exact silent-scanner set. A scanner can
+        // recover while another goes dark on the same file, so the set belongs
+        // in the session dedupe identity rather than only kind and path.
+        const silentScannerSet = [...new Set(unconfirmedServerIds)]
+            .map(normalizeMapKey)
+            // Code-unit comparator: the sorted set is a dedupe KEY, so ordering
+            // must be deterministic across locales — localeCompare is not.
+            .sort((a, b) => Number(a > b) - Number(a < b))
+            .join(",");
+        const onceKey = `${ctx.kind}:${normalizeMapKey(ctx.filePath)}:${silentScannerSet}`;
+        if (coverageNoticeSeen.has(onceKey))
+            return undefined;
+        coverageNoticeSeen.add(onceKey);
+        const shown = unconfirmedServerIds.slice(0, 4);
+        const remainder = unconfirmedServerIds.length - shown.length;
+        const marker = `${shown.join(", ")}${remainder > 0 ? ` +${remainder}` : ""}`;
+        return {
+            id: `coverage-partial:${ctx.kind}:${path.basename(ctx.filePath)}`,
+            message: `coverage: ${marker} silent — diagnostics are incomplete (not a clean result).`,
+            filePath: ctx.filePath,
+            severity: "warning",
+            semantic: "warning",
+            tool: "pi-lens",
+        };
+    }
     // Check primary runners first
     const primaryHasCoverage = relevant.some((r) => r.status === "succeeded" || r.status === "failed");
     if (primaryHasCoverage)
@@ -481,6 +614,9 @@ async function runGroup(ctx, group, registry, onRunnerResult) {
             status: result.status,
             diagnosticCount: result.diagnostics.length,
             semantic: result.semantic ?? semantic,
+            ...(result.unconfirmedServerIds !== undefined && {
+                unconfirmedServerIds: result.unconfirmedServerIds,
+            }),
         });
         logLatency({
             type: "runner",
@@ -638,11 +774,16 @@ export async function dispatchForFile(ctx, groups, registry, onRunnerResult) {
     const blockers = visibleDiagnostics.filter((d) => d.semantic === "blocking");
     const warnings = visibleDiagnostics.filter((d) => d.semantic === "warning" || d.semantic === "none");
     const fixedItems = visibleDiagnostics.filter((d) => d.semantic === "fixed");
-    // Append fixed and fixable diagnostics to the persistent worklog
+    // Append fixed and fixable diagnostics to the persistent worklog, attributed
+    // to the runtime's active model/provider when known (#1448).
+    const worklogIdentity = {
+        model: ctx.telemetryModel,
+        provider: ctx.telemetryProvider,
+    };
     if (fixedItems.length > 0) {
         import("../fix-worklog.js")
             .then(({ appendToWorklog }) => {
-            appendToWorklog(ctx.cwd, fixedItems, true);
+            appendToWorklog(ctx.cwd, fixedItems, true, worklogIdentity);
         })
             .catch(() => { });
     }
@@ -650,7 +791,7 @@ export async function dispatchForFile(ctx, groups, registry, onRunnerResult) {
     if (fixableWarnings.length > 0) {
         import("../fix-worklog.js")
             .then(({ appendToWorklog }) => {
-            appendToWorklog(ctx.cwd, fixableWarnings, false);
+            appendToWorklog(ctx.cwd, fixableWarnings, false, worklogIdentity);
         })
             .catch(() => { });
     }
@@ -755,6 +896,16 @@ function normalizeDiagnosticFilePath(ctx, rawPath) {
 async function runRunner(ctx, runner, defaultSemantic) {
     const timeoutMs = Math.max(runner.timeoutMs ?? RUNNER_TIMEOUT_MS, getRunnerTimeoutFloorMs());
     let timer;
+    // #1723: mark this runner as the in-flight phase for the WHOLE race below,
+    // not just the runner's own promise — a synchronous CPU hog inside
+    // `runner.run` (ast-grep-napi, tree-sitter, …) blocks the event loop before
+    // it ever gets to log its own completion, so `recentPhases` (which only
+    // records FINISHED phases) can't name it. `phaseFinished` clears on every
+    // exit from this race (success, runner error, or timeout) via try/finally,
+    // so a `loop_block` sampled after this call returns never sees a stale
+    // pointer. See `phaseStarted`'s doc comment for the identity-token
+    // reasoning and the cost note (negligible next to a runner invocation).
+    const phaseToken = phaseStarted(runner.id);
     try {
         const result = await Promise.race([
             runner.run(ctx).finally(() => clearTimeout(timer)),
@@ -784,6 +935,9 @@ async function runRunner(ctx, runner, defaultSemantic) {
             failureMessage: message.slice(0, 200),
         };
     }
+    finally {
+        phaseFinished(phaseToken);
+    }
 }
 // --- Simple Integration Helper ---
 /**