@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/run-duration.js

@@ -0,0 +1,55 @@
+/**
+ * #1479/#1480: one place decides whether a test run was actually timed, and
+ * one place renders the answer.
+ *
+ * `TestResult.duration` is optional, and the two states are different facts.
+ * A present number is a MEASUREMENT — including `0`, because pytest really
+ * does print `in 0.00s` and a suite whose `startTime` equals its `endTime`
+ * really did run in under a millisecond. An absent value means no
+ * runner-reported figure was found at all.
+ *
+ * That contract was written down once, in the doc comment on
+ * `TestResult.duration`, and then re-derived at every site that reads or
+ * produces a duration. A reader of any one of those sites cannot see the
+ * contract, and a producer that reaches for `0` when it means "did not
+ * measure" reintroduces exactly the defect #1479 removed. These three
+ * functions are the contract in executable form: `isMeasuredDuration`
+ * classifies, `toMeasuredDurationMs` normalises a freshly parsed figure into
+ * it, and `formatRunDurationMs` renders it.
+ *
+ * NOTE FOR ANYONE EDITING `isMeasuredDuration`: the predicate is `>= 0`, not
+ * `> 0`. A measured zero is real. `> 0` looks like a harmless tightening and
+ * is the single change that would silently restore the bug.
+ *
+ * Kept in its own module rather than exported from `test-runner-client.ts`:
+ * `runtime-turn.ts` needs it on the hot turn-end path, and the client is
+ * deliberately loaded lazily (`bootstrap.ts` dynamic-imports it), so a value
+ * import from there would drag the whole runner into startup.
+ */
+/**
+ * True only for a value that represents a real measurement.
+ *
+ * `0` is measured. `undefined`, `null`, `NaN`, the infinities, and a negative
+ * figure are not: the last three can only come from a garbled parse, and a
+ * garbled parse must degrade to "we did not measure this", never to a wrong
+ * number.
+ */
+export function isMeasuredDuration(duration) {
+    return (typeof duration === "number" && Number.isFinite(duration) && duration >= 0);
+}
+/**
+ * Normalise a parsed elapsed time to the `TestResult.duration` contract.
+ *
+ * Returns whole milliseconds for a real reading — `0` included — and
+ * `undefined` for anything that is not one, so a producer never has to spell
+ * out the absent case itself.
+ */
+export function toMeasuredDurationMs(duration) {
+    return isMeasuredDuration(duration) ? Math.round(duration) : undefined;
+}
+/** Render a duration for a log line: `123ms`, or `unmeasured` when absent. */
+export function formatRunDurationMs(duration) {
+    return isMeasuredDuration(duration)
+        ? `${Math.round(duration)}ms`
+        : "unmeasured";
+}

package/node_modules/pi-lens/dist/clients/runtime-agent-end.js

@@ -5,11 +5,13 @@ import { publishFilesTouched } from "./bus-publish.js";
 import { publishAutofixStart, publishFormatStart, } from "./format-events-publish.js";
 import { logLatency } from "./latency-logger.js";
 import { isPathIgnoredByProject } from "./file-utils.js";
+import { admitBounded, emitBounded } from "./bounded-telemetry.js";
 import { newLspMutationCorrelationId } from "./lsp-mutation.js";
 import { getGlobalActionableWarningMaxFixes, } from "./lens-config.js";
-import { resyncLspFile, runFormatPhase } from "./pipeline.js";
+import { resyncLspFile, runAutofix, runFormatPhase } from "./pipeline.js";
 import { getAmbientAbortSignal } from "./safe-spawn.js";
 import { appendProjectChange, } from "./project-changes.js";
+import { getAutofixPolicyForFile, hasBiomeConfig, hasDetektConfig, hasEslintConfig, hasGolangciConfig, hasKtfmtConfig, hasKtlintConfig, hasOxlintConfig, hasRubocopConfig, hasSqlfluffConfig, hasStylelintConfig, } from "./tool-policy.js";
 /**
  * A queued file is claimed by any flush once it has sat unclaimed by its own
  * owning session for this long — recovery for an orphaned record whose
@@ -40,21 +42,128 @@ function recordProjectChange(args) {
         args.dbg(`project change log append failed for ${args.filePath}: ${err}`);
     }
 }
-export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, dbg, runtime, cacheManager, getFormatService, currentSessionId, staleAfterMs = DEFERRED_FORMAT_STALE_AFTER_MS, }) {
+export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, dbg, runtime, cacheManager, getFormatService, biomeClient, ruffClient, getAutofixClients, currentSessionId, staleAfterMs = DEFERRED_FORMAT_STALE_AFTER_MS, }) {
     // #791: ownership-filtered drain — records queued by a DIFFERENT known
     // session (e.g. a concurrent in-process secondary/subagent) stay queued
     // for their owner's own agent_end, unless they've been stale long enough
     // to fall back to "claim as orphaned" (see claimDeferredFormatFiles).
-    const { claimed, staleClaimed, deferredToOwner } = runtime.claimDeferredFormatFiles(currentSessionId, Date.now(), staleAfterMs);
+    const { claimed, staleClaimed, deferredToOwner, droppedOrphans } = runtime.claimDeferredMutations(currentSessionId, Date.now(), staleAfterMs, ctxCwd ?? runtime.projectRoot);
     const records = [...claimed, ...staleClaimed];
+    const requeuedKinds = new Set();
+    // S2d (gap 4, #1432 review): the aggregate `agent_end_deferred_mutation_drain`
+    // row only carried a coalesced `requeuedKinds` set with no reason, per-call
+    // file count, or tool provenance — every requeue (abort mid-drain, missing
+    // autofix clients, an autofix/format failure) collapsed into one
+    // indistinguishable bucket. Log one bounded record PER requeue call instead,
+    // so a real incident can tell "aborted with N files still queued" apart
+    // from "M files failed to format".
+    const requeue = (pending, reason) => {
+        if (pending.length === 0)
+            return;
+        const kinds = new Set();
+        const toolNames = new Set();
+        for (const record of pending) {
+            for (const kind of record.kinds) {
+                requeuedKinds.add(kind);
+                kinds.add(kind);
+            }
+            for (const toolName of record.toolNames)
+                toolNames.add(toolName);
+        }
+        logLatency({
+            type: "phase",
+            toolName: "agent_end",
+            filePath: ctxCwd ?? runtime.projectRoot,
+            phase: "agent_end_deferred_mutation_requeue",
+            durationMs: 0,
+            metadata: {
+                reason,
+                kinds: [...kinds].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
+                fileCount: pending.length,
+                toolNames: [...toolNames].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
+            },
+        });
+        runtime.requeueDeferredMutations(pending);
+    };
     const rootActionableAutofixEnabled = !!getFlag("lens-actionable-warning-autofix");
+    // The actionable-warnings cache is only ever written when the
+    // "lens-actionable-warnings" writer flag is on (clients/runtime-turn.ts).
+    // A reader that ignores this gate always misses in a host where the
+    // writer is off and logs "cache missing or expired" at every agent_end,
+    // misdirecting the debug log toward a bogus cache problem instead of the
+    // real cause: the feature that populates the cache is disabled (#1607).
+    const actionableWarningsWriterEnabled = !!getFlag("lens-actionable-warnings");
     // A path-aware source resolver signals that nested configs may re-enable
     // actionable autofix even when the root default is off. Legacy/test hosts
     // without that resolver keep the old fast exit and avoid a cache read.
-    const inspectActionableReport = rootActionableAutofixEnabled && typeof cacheManager.readCache === "function"
-        ? true
-        : getFlagSource !== undefined &&
-            typeof cacheManager.readCache === "function";
+    const inspectActionableReport = actionableWarningsWriterEnabled &&
+        typeof cacheManager.readCache === "function" &&
+        (rootActionableAutofixEnabled || getFlagSource !== undefined);
+    if (droppedOrphans.length > 0) {
+        // #1642 F3: a stale/foreign record whose origin (the cwd/worktree it
+        // was actually queued under) does NOT match this flush's own
+        // workspace/worktree is left queued and NEVER formatted by this
+        // flush — claiming it would be the same worktree→parent
+        // re-attribution the reported incident hit, just via the orphan
+        // fallback instead of tool_result's path resolution. It stays in
+        // `_pendingDeferredMutations` (not deleted) so a flush whose origin
+        // actually matches can still claim it later; a genuinely abandoned
+        // origin will keep surfacing this record on every subsequent
+        // agent_end, which is the deliberately safer trade-off over silently
+        // losing it forever.
+        dbg(`agent_end deferred_format: left ${droppedOrphans.length} orphaned file(s) queued due to a mismatched origin (unclaimed >${staleAfterMs}ms, not formatted by this flush): ${droppedOrphans
+            .map((r) => `${r.filePath} origin=${r.originCwd}`)
+            .join(", ")}`);
+        // #1678 item 1: a genuinely abandoned origin re-surfaces the SAME
+        // record on every subsequent agent_end for as long as the queued
+        // entry lives — by design (see the comment above), but the repo
+        // invariant is that a repeated degradation goes through the ledger's
+        // counting path instead of accumulating as unbounded raw log lines.
+        // The ledger is the single source of truth for whether THIS is a
+        // record's first appearance (its return value): the detailed forensic
+        // record below names only the orphans on that rising edge, with file
+        // identity/origin/age. Every later repeat of
+        // the same record is counted ONLY by the ledger's running count —
+        // no second raw event, no parallel "already logged" latch to
+        // maintain here.
+        // #1743: `admitBounded` IS that ledger call, plus the registry
+        // membership the bounded-telemetry sweep checks. This site admits PER
+        // ORPHAN and then writes ONE batched record naming the admitted ones,
+        // which is why it uses `admitBounded` directly instead of a per-record
+        // `emitBounded` — the per-call form would turn one log line into N.
+        const firstSeenOrphans = [];
+        for (const record of droppedOrphans) {
+            const isFirstOccurrence = admitBounded("agent_end_deferred_format_orphan_origin_mismatch", record.filePath, {
+                ledgerKind: "path-attribution-orphan-unresolved",
+                risingEdgePer: "identity",
+                reason: `origin=${record.originCwd} unclaimed >${staleAfterMs}ms`,
+            });
+            if (isFirstOccurrence)
+                firstSeenOrphans.push(record);
+        }
+        if (firstSeenOrphans.length > 0) {
+            // Already admitted above, one orphan at a time — hence no bounding
+            // options here. The batch's own identity is the origin this flush ran
+            // under; per-file identity rides in `metadata.files`.
+            emitBounded("agent_end_deferred_format_orphan_origin_mismatch", ctxCwd ?? runtime.projectRoot, {
+                type: "phase",
+                toolName: "agent_end",
+                durationMs: 0,
+                metadata: {
+                    fileCount: firstSeenOrphans.length,
+                    staleAfterMs,
+                    currentOriginCwd: ctxCwd ?? runtime.projectRoot,
+                    files: firstSeenOrphans.map((r) => ({
+                        filePath: r.filePath,
+                        originCwd: r.originCwd,
+                        ownerSessionId: r.ownerSessionId,
+                        queuedTurnIndex: r.queuedTurnIndex,
+                        ageMs: Date.now() - r.lastTouchedAt,
+                    })),
+                },
+            });
+        }
+    }
     if (records.length === 0 && !inspectActionableReport)
         return undefined;
     if (deferredToOwner.length > 0) {
@@ -97,6 +206,86 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
     // publishFilesTouched call so consumers can tell "pi-lens formatted this"
     // from an agent edit.
     const deferredFormatFixes = [];
+    const deferredAutofixFixes = [];
+    const deferredAutofixChanged = new Set();
+    // Mutation ordering is intentional: lint --write may disturb wrapping, so
+    // autofix reaches the final edited state first and formatting stabilizes it.
+    const ambientSignal = getAmbientAbortSignal();
+    const executedAutofixScopes = new Set();
+    const autofixRecords = records.filter((candidate) => candidate.kinds.has("autofix"));
+    if (autofixRecords.length > 0 && (!biomeClient || !ruffClient) && getAutofixClients) {
+        ({ biomeClient, ruffClient } = await getAutofixClients());
+    }
+    for (let autofixIndex = 0; autofixIndex < autofixRecords.length; autofixIndex++) {
+        const record = autofixRecords[autofixIndex];
+        if (ambientSignal?.aborted) {
+            requeue(autofixRecords.slice(autofixIndex).map((pending) => ({
+                ...pending,
+                kinds: new Set(["autofix"]),
+                toolNames: new Set(pending.toolNames),
+            })), "abort");
+            break;
+        }
+        const filePath = path.resolve(record.filePath);
+        if (!nodeFs.existsSync(filePath)) {
+            summary.skipped.push({ filePath, reason: "missing" });
+            continue;
+        }
+        if (!biomeClient || !ruffClient) {
+            dbg(`agent_end deferred_autofix: clients unavailable for ${filePath}`);
+            requeue([{ ...record, kinds: new Set(["autofix"]), toolNames: new Set(record.toolNames) }], "clients-unavailable");
+            continue;
+        }
+        const policy = getAutofixPolicyForFile(filePath, {
+            hasEslintConfig: hasEslintConfig(record.cwd),
+            hasStylelintConfig: hasStylelintConfig(record.cwd),
+            hasSqlfluffConfig: hasSqlfluffConfig(record.cwd),
+            hasRubocopConfig: hasRubocopConfig(record.cwd),
+            hasBiomeConfig: hasBiomeConfig(record.cwd),
+            hasGolangciConfig: hasGolangciConfig(record.cwd),
+            hasDetektConfig: hasDetektConfig(record.cwd),
+            hasOxlintConfig: hasOxlintConfig(record.cwd),
+            hasKtfmtConfig: hasKtfmtConfig(record.cwd),
+            hasKtlintConfig: hasKtlintConfig(record.cwd),
+        });
+        const scopeKey = policy?.scope && policy.scope !== "file"
+            ? `${policy.defaultTool ?? "unknown"}:${path.resolve(record.cwd)}`
+            : `${policy?.defaultTool ?? "unknown"}:${filePath}`;
+        if (executedAutofixScopes.has(scopeKey))
+            continue;
+        executedAutofixScopes.add(scopeKey);
+        try {
+            const result = await runAutofix(filePath, record.cwd, getFlag, dbg, { biomeClient, ruffClient, fixedThisTurn: runtime.fixedThisTurn }, getFlagSource);
+            const tools = result.autofixTools.map((label) => label.split(":")[0]);
+            for (const changed of result.changedFiles) {
+                const changedPath = path.resolve(changed);
+                deferredAutofixChanged.add(changedPath);
+                for (const tool of tools)
+                    deferredAutofixFixes.push({ path: changedPath, tool, kind: "autofix" });
+                if (!nodeFs.existsSync(changedPath))
+                    continue;
+                recordProjectChange({ runtime, cwd: record.turnStateCwd, filePath: changedPath, source: "autofix", dbg });
+                if (!getFlag("no-read-guard"))
+                    runtime.readGuard.recordWritten(changedPath);
+                const content = nodeFs.readFileSync(changedPath, "utf-8");
+                cacheManager.addModifiedRange(changedPath, { start: 1, end: content.split("\n").length }, /^import\s/m.test(content), record.turnStateCwd, currentSessionId ?? runtime.telemetrySessionId, "pi");
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            summary.failed.push({ filePath, errors: [message] });
+            requeue([{ ...record, kinds: new Set(["autofix"]), toolNames: new Set(record.toolNames) }], "autofix-failed");
+        }
+    }
+    if (deferredAutofixFixes.length > 0) {
+        publishFilesTouched({
+            reason: "autofix",
+            paths: [...new Set(deferredAutofixFixes.map((fix) => fix.path))],
+            cwd: ctxCwd ?? runtime.projectRoot,
+            dbg,
+            fixes: deferredAutofixFixes,
+        });
+    }
     dbg(`agent_end deferred_format: ${records.length} file(s)`);
     logLatency({
         type: "phase",
@@ -127,9 +316,10 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
             cwd: ctxCwd ?? runtime.projectRoot,
             paths: records.map((r) => r.filePath),
             dbg,
+            kinds: [...new Set(records.flatMap((record) => [...record.kinds]))],
         });
     }
-    const formatRecords = records.filter((record) => {
+    const formatRecords = records.filter((record) => record.kinds.has("format")).filter((record) => {
         const disabled = !!getFlag("no-autoformat", record.filePath);
         if (disabled) {
             const source = getFlagSource?.("no-autoformat", record.filePath);
@@ -145,7 +335,6 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
         const work = new Array(formatRecords.length);
         const started = new Set();
         let nextIndex = 0;
-        const ambientSignal = getAmbientAbortSignal();
         const worker = async () => {
             while (nextIndex < formatRecords.length) {
                 const index = nextIndex++;
@@ -179,7 +368,11 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
         };
         await Promise.all(Array.from({ length: Math.min(DEFERRED_FORMAT_CONCURRENCY, formatRecords.length) }, () => worker()));
         if (ambientSignal?.aborted) {
-            runtime.requeueDeferredFormatFiles(formatRecords.filter((_, index) => !started.has(index)));
+            requeue(formatRecords.filter((_, index) => !started.has(index)).map((record) => ({
+                ...record,
+                kinds: new Set(["format"]),
+                toolNames: new Set(record.toolNames),
+            })), "abort");
         }
         for (const entry of work) {
             if (!entry)
@@ -188,12 +381,15 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
             const { record, filePath, fileStart } = entry;
             if (entry.missing) {
                 dbg(`agent_end deferred_format skipped missing file: ${filePath}`);
-                summary.skipped.push({ filePath, reason: "missing" });
+                if (!summary.skipped.some((item) => item.filePath === filePath && item.reason === "missing")) {
+                    summary.skipped.push({ filePath, reason: "missing" });
+                }
                 continue;
             }
             if (entry.error) {
                 dbg(`agent_end deferred_format failed for ${filePath}: ${entry.error}`);
                 summary.failed.push({ filePath, errors: [entry.error] });
+                requeue([{ ...record, kinds: new Set(["format"]), toolNames: new Set(record.toolNames) }], "format-failed");
                 continue;
             }
             const result = entry.result;
@@ -202,6 +398,7 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
             summary.formatted++;
             if (result.formatFailures.length > 0) {
                 summary.failed.push({ filePath, errors: result.formatFailures });
+                requeue([{ ...record, kinds: new Set(["format"]), toolNames: new Set(record.toolNames) }], "format-failed");
             }
             if (result.formatChanged) {
                 summary.changed.push(filePath);
@@ -268,10 +465,35 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
             });
         }
     }
+    // LSP sees only authoritative content after both mutation phases. In
+    // particular, never publish the autofix intermediate state before format.
+    for (const changedPath of deferredAutofixChanged) {
+        if (!nodeFs.existsSync(changedPath))
+            continue;
+        const content = nodeFs.readFileSync(changedPath, "utf-8");
+        await resyncLspFile(changedPath, content, true, false, getFlag, dbg);
+    }
     if (inspectActionableReport) {
-        const actionReport = cacheManager.readCache("actionable-warnings", ctxCwd ?? runtime.projectRoot, 10 * 60_000);
+        const actionCwd = ctxCwd ?? runtime.projectRoot;
+        const actionableWarningsMaxAgeMs = 10 * 60_000;
+        const actionReport = cacheManager.readCache("actionable-warnings", actionCwd, actionableWarningsMaxAgeMs);
         if (!actionReport?.data) {
-            dbg("agent_end actionable_warnings_autofix: cache missing or expired, skipping fixes");
+            // Distinguish "no cache file was ever written" from "a cache file
+            // exists but its TTL elapsed" (#1607) — both used to collapse into
+            // one "cache missing or expired" line, which doesn't tell a reader
+            // whether the writer ran and produced a stale file, or never ran.
+            const inspection = typeof cacheManager.inspectCache === "function"
+                ? cacheManager.inspectCache("actionable-warnings", actionCwd, actionableWarningsMaxAgeMs)
+                : undefined;
+            if (inspection === "missing") {
+                dbg("agent_end actionable_warnings_autofix: cache absent, skipping fixes");
+            }
+            else if (inspection === "stale") {
+                dbg("agent_end actionable_warnings_autofix: cache expired, skipping fixes");
+            }
+            else {
+                dbg(`agent_end actionable_warnings_autofix: cache missing or expired${inspection ? ` (${inspection})` : ""}, skipping fixes`);
+            }
         }
         else {
             const enabledFiles = actionReport.data.files.filter((file) => {
@@ -384,6 +606,19 @@ export async function handleAgentEnd({ ctxCwd, getFlag, getFlagSource, notify, d
             }
         }
     }
+    logLatency({
+        type: "phase",
+        toolName: "agent_end",
+        filePath: ctxCwd ?? runtime.projectRoot,
+        phase: "agent_end_deferred_mutation_drain",
+        durationMs: Date.now() - startedAt,
+        metadata: {
+            autofixRecords: autofixRecords.length,
+            formatRecords: formatRecords.length,
+            coalescedPaths: records.length,
+            requeuedKinds: [...requeuedKinds].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
+        },
+    });
     logLatency({
         type: "tool_result",
         toolName: "agent_end",

package/node_modules/pi-lens/dist/clients/runtime-context.js

@@ -1,22 +1,72 @@
+import { provenanceStamp, validateAdvisoryProvenance, } from "./advisory-provenance.js";
+import { logLatency } from "./latency-logger.js";
 // Exported so the Stop-hook bin strips exactly what these bridges prepend.
 export const AUTOMATION_FRAMING = "[pi-lens automated check — not a user request] ";
-function turnEndMessage(content) {
+// #1432 review (S3b): a multi-file bash write can carry hundreds of changed
+// paths, one `reasons` entry apiece — logging all of them shrinks the
+// smells-rollup tail window (a fixed-size ring) to a handful of these
+// records. Cap what this decision row carries; the full list is never
+// needed for triage, only "how many and roughly what kind".
+const MAX_LOGGED_REASONS = 8;
+function boundedReasons(reasons) {
+    if (reasons.length <= MAX_LOGGED_REASONS)
+        return reasons;
+    return [
+        ...reasons.slice(0, MAX_LOGGED_REASONS),
+        `+${reasons.length - MAX_LOGGED_REASONS} more`,
+    ];
+}
+function logProvenanceDecision(validation, provenance, advisoryKind, cwd) {
+    logLatency({
+        type: "phase",
+        phase: "advisory_provenance_decision",
+        filePath: cwd,
+        durationMs: 0,
+        metadata: {
+            decision: validation.status === "current" ? "current" : "historical",
+            reasons: boundedReasons(validation.reasons),
+            changedPathCount: validation.changedPathCount,
+            provenanceStamp: provenanceStamp(provenance),
+            advisoryKind,
+        },
+    });
+}
+function historicalPrefix(provenance) {
+    return `Historical finding; workspace changed since capture; re-run to confirm. (${provenanceStamp(provenance)})`;
+}
+function historicalTestContent(content, provenance) {
+    return content.startsWith("[from a prior turn")
+        ? content
+        : `${historicalPrefix(provenance)}\n\n${content}`;
+}
+function turnEndMessage(content, current, provenance) {
     return {
         role: "user",
-        content: `${AUTOMATION_FRAMING}Address 🔴 blockers before continuing; ℹ️ advisories are informational only.\n\n${content}`,
+        content: current
+            ? `${AUTOMATION_FRAMING}Address 🔴 blockers before continuing; ℹ️ advisories are informational only.\n\n${content}`
+            : `${AUTOMATION_FRAMING}${historicalPrefix(provenance)}\n\n${content}`,
     };
 }
 /** Read a turn-end finding without changing its durable delivery state. */
-export function peekTurnEndFindings(cacheManager, cwd) {
+export function peekTurnEndFindings(cacheManager, cwd, runtime, logDelivery = false) {
     const findings = cacheManager.readCache("turn-end-findings", cwd);
     if (!findings?.data?.content || findings.data.consumed === true)
         return;
-    return { messages: [turnEndMessage(findings.data.content)] };
+    const validation = validateAdvisoryProvenance(findings.data, cwd, runtime);
+    if (logDelivery)
+        logProvenanceDecision(validation, findings.data.provenance, "turn-end", cwd);
+    if (validation.allFilesDeleted)
+        return;
+    return {
+        messages: [turnEndMessage(findings.data.content, validation.status === "current", findings.data.provenance)],
+    };
 }
-export function consumeTurnEndFindings(cacheManager, cwd) {
+export function consumeTurnEndFindings(cacheManager, cwd, runtime) {
     const findings = cacheManager.readCache("turn-end-findings", cwd);
     if (!findings?.data?.content || findings.data.consumed === true)
         return;
+    const validation = validateAdvisoryProvenance(findings.data, cwd, runtime);
+    logProvenanceDecision(validation, findings.data.provenance, "turn-end", cwd);
     // A blocker record is also the opt-in commit gate's durable state. Mark the
     // context message consumed without deleting the record; clean/advisory-only
     // records retain the historical consume-and-clear behavior.
@@ -27,34 +77,84 @@ export function consumeTurnEndFindings(cacheManager, cwd) {
     else {
         cacheManager.clearCache("turn-end-findings", cwd);
     }
-    return { messages: [turnEndMessage(findings.data.content)] };
+    if (validation.allFilesDeleted)
+        return;
+    return {
+        messages: [turnEndMessage(findings.data.content, validation.status === "current", findings.data.provenance)],
+    };
 }
 /** Read test findings without consuming them; used by acknowledged IPC delivery. */
-export function peekTestFindings(cacheManager, cwd) {
+export function peekTestFindings(cacheManager, cwd, runtime, logDelivery = false) {
     const findings = cacheManager.readCache("test-runner-findings", cwd);
     if (!findings?.data?.content)
         return;
+    const validation = validateAdvisoryProvenance(findings.data, cwd, runtime);
+    if (logDelivery)
+        logProvenanceDecision(validation, findings.data.provenance, "test-findings", cwd);
+    if (validation.allFilesDeleted)
+        return;
+    const current = validation.status === "current";
     return {
         messages: [
             {
                 role: "user",
-                content: `${AUTOMATION_FRAMING}Test failures detected last turn — fix before continuing:\n\n${findings.data.content}`,
+                content: current
+                    ? `${AUTOMATION_FRAMING}Test failures detected last turn — fix before continuing:\n\n${findings.data.content}`
+                    : `${AUTOMATION_FRAMING}${historicalTestContent(findings.data.content, findings.data.provenance)}`,
             },
         ],
     };
 }
-export function consumeTestFindings(cacheManager, cwd) {
-    const findings = peekTestFindings(cacheManager, cwd);
+export function consumeTestFindings(cacheManager, cwd, runtime) {
+    const record = cacheManager.readCache("test-runner-findings", cwd);
+    if (!record?.data?.content)
+        return;
+    const findings = peekTestFindings(cacheManager, cwd, runtime, true);
     if (!findings)
         return;
-    cacheManager.writeCache("test-runner-findings", null, cwd);
+    // Retire the content but PRESERVE the generation high-water mark: nulling
+    // the whole slot would let a still-in-flight OLDER batch see `undefined`,
+    // pass the strictly-greater suppression check, and resurrect a consumed
+    // one-shot advisory with stale results. An empty-content record peeks as
+    // undelivered while keeping late-generation ordering intact.
+    const priorGeneration = cacheManager.readCache("test-runner-findings", cwd)?.data?.testRunGeneration;
+    cacheManager.writeCache("test-runner-findings", { content: "", testRunGeneration: priorGeneration }, cwd);
     return findings;
 }
+/** Complete an acknowledged MCP delivery without re-validating or re-rendering it. */
+export function acknowledgeTurnEndFindings(cacheManager, cwd) {
+    const findings = cacheManager.readCache("turn-end-findings", cwd);
+    if (!findings?.data?.content || findings.data.consumed === true)
+        return;
+    if (findings.data.hasBlockers === true && typeof findings.data.sessionId === "string") {
+        cacheManager.writeCache("turn-end-findings", { ...findings.data, consumed: true }, cwd);
+    }
+    else {
+        cacheManager.clearCache("turn-end-findings", cwd);
+    }
+}
+export function acknowledgeTestFindings(cacheManager, cwd) {
+    const findings = cacheManager.readCache("test-runner-findings", cwd);
+    if (!findings?.data?.content)
+        return;
+    // Same high-water-mark preservation as consumeTestFindings.
+    cacheManager.writeCache("test-runner-findings", {
+        content: "",
+        testRunGeneration: findings.data.testRunGeneration,
+    }, cwd);
+}
 export function consumeSessionStartGuidance(cacheManager, cwd) {
     const guidance = cacheManager.readCache("session-start-guidance", cwd);
     if (!guidance?.data?.content)
         return;
-    cacheManager.writeCache("session-start-guidance", null, cwd);
+    // Consume by writing empty guidance, not by casting `null` into the entry's
+    // own type. `writeCache` infers its type parameter from `data`, so the cast
+    // bought nothing and claimed the file held a `{ content: string }` when it
+    // held JSON `null`. The producer (`runtime-session.ts`) always writes
+    // `{ content }`, and this reader gates on `data?.content` being non-empty,
+    // so an empty string is the same "already consumed" signal with the type
+    // the entry actually has. Same idiom as `acknowledgeTestFindings` above.
+    cacheManager.writeCache("session-start-guidance", { content: "" }, cwd);
     return {
         messages: [
             {