@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/runtime-coordinator.js

@@ -1,11 +1,29 @@
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { normalizeMapKey } from "./path-utils.js";
+import { logCascade } from "./cascade-logger.js";
+import { normalizeMapKey, pathsEqual } from "./path-utils.js";
 import { PathKeyedMap } from "./path-keyed-map.js";
+import { BoundedLruCache } from "./bounded-cache.js";
 import { ReadGuard } from "./read-guard.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { TurnSummaryCollector } from "./turn-summary.js";
+import { deriveProviderFromModelId } from "./model-provider.js";
+/**
+ * Bound on in-flight tool_call → tool_result correlations. A tool_result
+ * follows its tool_call almost immediately, so this only needs to cover
+ * calls genuinely in flight; sized generously above any realistic
+ * in-flight-batch width so a slow paired result is never evicted before use.
+ */
+const TOOL_CALL_ATTRIBUTION_CAPACITY = 256;
+/**
+ * A recorded attribution older than this is treated as expired (as if it
+ * were never recorded) rather than trusted — defense in depth against a host
+ * that reuses a call id, or a pathologically delayed/duplicated tool_result,
+ * outliving the LRU capacity bound. Generous relative to any real tool
+ * round-trip; only guards against genuine identity reuse, not slow tools.
+ */
+const TOOL_CALL_ATTRIBUTION_TTL_MS = 5 * 60_000;
 export class RuntimeCoordinator {
     _projectRoot = normalizeMapKey(process.cwd());
     _sessionGeneration = 0;
@@ -15,6 +33,8 @@ export class RuntimeCoordinator {
     _cachedExports = new Map();
     _startupScansInFlight = new Map();
     _cascadeRuns = [];
+    _turnEndCascadeSettleStarts = new Map();
+    _nextCascadeSettleToken = 0;
     // Cascade computes are kicked off unawaited by the pipeline (#450); their
     // promises park here until turn_end drains them via settleCascadeRuns. Each is
     // guaranteed non-rejecting by the pipeline's .catch.
@@ -25,7 +45,9 @@ export class RuntimeCoordinator {
         coldSnapshotTouches: 0,
     };
     _complexityBaselines = new Map();
-    _fixedThisTurn = new Set();
+    _fixedThisTurn = new PathKeyedMap(normalizeMapKey);
+    _writtenThisTurn = new PathKeyedMap(normalizeMapKey);
+    _autofixDemotedThisTurn = new PathKeyedMap(normalizeMapKey);
     _reportedThisTurn = new Set();
     _projectRulesScan = {
         rules: [],
@@ -35,6 +57,19 @@ export class RuntimeCoordinator {
     _lifecycleReason;
     _hasStableSessionId = false;
     _telemetryModel = "unknown";
+    // Raw model/provider identity, separate from the combined `provider/model`
+    // display string above — worklog/disposition attribution (#1448) wants the
+    // two fields apart, blank when the host never supplied them. `_telemetryProvider`
+    // is the explicit host value when given, else derived from the model id
+    // (deriveProviderFromModelId, blank on ambiguity — never guessed).
+    _telemetryModelId = "";
+    _telemetryProvider = "";
+    // True once a host has supplied an explicit provider this session. An
+    // explicit provider is never downgraded by a derivation from a later
+    // model-only call; a DERIVED provider, by contrast, is re-derived on
+    // every model-only call so a mid-session model switch (e.g. gpt-5-mini →
+    // claude-sonnet-4-5) doesn't leave a stale provider from the old model.
+    _telemetryProviderIsExplicit = false;
     _turnIndex = 0;
     _writeIndex = 0;
     _projectSeq = 0;
@@ -51,7 +86,9 @@ export class RuntimeCoordinator {
     callGraph = null;
     wordIndex = null;
     _readGuard = null;
-    _pendingDeferredFormatFiles = new Map();
+    _pendingDeferredMutations = new PathKeyedMap(normalizeMapKey);
+    /** tool_call → tool_result path-attribution correlation (#1642). */
+    _toolCallAttributions = new BoundedLruCache(TOOL_CALL_ATTRIBUTION_CAPACITY);
     _lspReadWarmState = new Map();
     _pendingInlineBlockers = new PathKeyedMap(normalizeMapKey);
     _actionableWarningsThisTurn = new Map();
@@ -72,16 +109,22 @@ export class RuntimeCoordinator {
         this._startupScansInFlight.clear();
         this._cascadeRuns = [];
         this._pendingCascadeRuns = [];
+        this._turnEndCascadeSettleStarts.clear();
         this._cascadeSessionStats = {
             runs: 0,
             diagnosticsSurfaced: 0,
             coldSnapshotTouches: 0,
         };
         this._fixedThisTurn.clear();
+        this._writtenThisTurn.clear();
+        this._autofixDemotedThisTurn.clear();
         this._reportedThisTurn.clear();
         this._telemetrySessionId = `lens-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`;
         this._hasStableSessionId = false;
         this._telemetryModel = "unknown";
+        this._telemetryModelId = "";
+        this._telemetryProvider = "";
+        this._telemetryProviderIsExplicit = false;
         this._turnIndex = 0;
         this._writeIndex = 0;
         this._projectSeq = 0;
@@ -92,7 +135,11 @@ export class RuntimeCoordinator {
         this._gitGuardSummary = "";
         this._gitGuardCacheUnknownReason = undefined;
         this._readGuard = null;
-        this._pendingDeferredFormatFiles.clear();
+        this._pendingDeferredMutations.clear();
+        // #1642 F5: every sibling correlation/state map is cleared here. A
+        // per-session-numbered host reusing tool-call ids across sessions must
+        // not let a NEW session inherit a DEAD session's recorded skip verdict.
+        this._toolCallAttributions.clear();
         this._lspReadWarmState.clear();
         this._pendingInlineBlockers.clear();
         this._actionableWarningsThisTurn.clear();
@@ -145,7 +192,30 @@ export class RuntimeCoordinator {
         return this._gitGuardCacheUnknownReason;
     }
     beginTurn() {
-        this._cascadeRuns = [];
+        // #1443: runs sitting here at turn_start were appended AFTER the last
+        // turn_end drained them (consumeCascadeRuns) — the quiet-window reconcile's
+        // late re-injection (`onResolvedFound`, clients/lsp/cascade-tier.ts) lands
+        // in exactly that window. Wiping them dead-ended that delivery path: the
+        // finding was computed, formatted, appended, and then deleted before any
+        // turn_end could render it. Carry them into THIS turn instead, exactly
+        // once: `carriedTurns` is stamped on the way through and a run that the
+        // next turn_end still did not consume is dropped here with a log line
+        // rather than queued forever (a stale finding must not outlive the state
+        // it describes, and an unbounded queue would replay it every turn).
+        this._cascadeRuns = this._cascadeRuns.flatMap((run) => {
+            const carriedTurns = (run.carriedTurns ?? 0) + 1;
+            if (carriedTurns > 1) {
+                logCascade({
+                    phase: "cascade_carry_over_drop",
+                    filePath: run.filePath,
+                    neighborCount: run.neighborCount,
+                    diagnosticCount: run.diagnosticCount,
+                    metadata: { carriedTurns, turnIndex: this._turnIndex },
+                });
+                return [];
+            }
+            return [{ ...run, carriedTurns }];
+        });
         // _pendingCascadeRuns is deliberately NOT cleared here: a cascade compute
         // still in flight past last turn_end's settle cap (fresh graph builds have
         // measured up to ~19s) must surface on the NEXT turn_end, not be dropped —
@@ -166,6 +236,25 @@ export class RuntimeCoordinator {
         this._turnIndex += 1;
         this._writeIndex = 0;
         this._reportedThisTurn.clear();
+        this._writtenThisTurn.clear();
+        this._autofixDemotedThisTurn.clear();
+    }
+    /** Atomically records write/edit ordering before debounce can coalesce it. */
+    recordMutationToolReceipt(filePath, toolName) {
+        if (toolName === "write") {
+            this._writtenThisTurn.set(filePath, true);
+        }
+        else if (this._writtenThisTurn.has(filePath)) {
+            this._autofixDemotedThisTurn.set(filePath, true);
+            // A later edit establishes a new final state that must be eligible for
+            // the deferred pass even if the preceding write was fixed immediately.
+            this._fixedThisTurn.delete(filePath);
+        }
+        return {
+            autofixMode: toolName === "edit" || this._autofixDemotedThisTurn.has(filePath)
+                ? "deferred"
+                : "immediate",
+        };
     }
     get reportedThisTurn() {
         return this._reportedThisTurn;
@@ -192,6 +281,23 @@ export class RuntimeCoordinator {
         else if (provider) {
             this._telemetryModel = provider;
         }
+        if (model)
+            this._telemetryModelId = model;
+        if (provider) {
+            this._telemetryProvider = provider;
+            this._telemetryProviderIsExplicit = true;
+        }
+        else if (model && !this._telemetryProviderIsExplicit) {
+            // No explicit provider has ever been reported this session, so the
+            // provider is (still) a derivation — re-derive it from the CURRENT
+            // model id every time. Without this, a stale derived provider from
+            // an earlier model would survive a mid-session model switch (e.g.
+            // gpt-5-mini → claude-sonnet-4-5 with no explicit provider on
+            // either call) because the old "has any provider ever been set"
+            // guard treated the derived value as sticky. An explicit provider,
+            // once set, is never touched here regardless of later model calls.
+            this._telemetryProvider = deriveProviderFromModelId(model);
+        }
     }
     get telemetrySessionId() {
         return this._telemetrySessionId;
@@ -220,6 +326,17 @@ export class RuntimeCoordinator {
     get telemetryModel() {
         return this._telemetryModel;
     }
+    /** Raw model id (never the combined `provider/model` display string), blank
+     * when the host hasn't reported one this session. Worklog/disposition
+     * attribution (#1448) reads this, not {@link telemetryModel}. */
+    get telemetryModelId() {
+        return this._telemetryModelId;
+    }
+    /** Explicit host-reported provider, or a conservative derivation from the
+     * model id (see clients/model-provider.ts), blank when neither is known. */
+    get telemetryProviderId() {
+        return this._telemetryProvider;
+    }
     get turnIndex() {
         return this._turnIndex;
     }
@@ -329,6 +446,24 @@ export class RuntimeCoordinator {
     appendCascadePromise(p) {
         this._pendingCascadeRuns.push(p);
     }
+    /**
+     * The active turn_end settle clock, or undefined outside that wait.
+     *
+     * #1462 review F-F: every cascade compute in flight on this coordinator
+     * reads the SAME clock. `_turnEndCascadeSettleStarts` is keyed by settle
+     * token so `settleCascadeRuns` can distinguish its own drain from a nested
+     * one, but this getter always answers with the latest active window —
+     * there is one turn_end per runtime, not one per caller. A cascade begun
+     * moments before turn_end and one begun long before it both measure elapsed
+     * time against the same start, which is correct: they are racing the same
+     * settle wait and share its deadline, not separate ones.
+     */
+    getTurnEndCascadeSettleStart() {
+        let latest;
+        for (const start of this._turnEndCascadeSettleStarts.values())
+            latest = start;
+        return latest;
+    }
     /**
      * Drain the deferred cascade computes kicked off this turn (#450), racing them
      * against a bounded wait. Fulfilled runs feed the same accumulator as inline
@@ -336,57 +471,206 @@ export class RuntimeCoordinator {
      * late-resolving compute is picked up on the next turn_end rather than lost.
      * The stored promises never reject (pipeline guarantees an "error" skip-run).
      */
-    async settleCascadeRuns(maxWaitMs) {
+    async settleCascadeRuns(maxWaitMs, settleOptions = {}) {
         const pending = this._pendingCascadeRuns;
         if (pending.length === 0)
             return { settled: 0, timedOut: 0 };
         this._pendingCascadeRuns = [];
-        // Track per-promise settlement so promises still in flight at the cap can be
-        // carried over. A settled entry records its run; an unsettled one is re-parked.
-        const tracked = pending.map((p) => {
-            const entry = { done: false, promise: p };
-            entry.promise = p.then((run) => {
-                entry.done = true;
-                entry.run = run;
-                return run;
+        const settleToken = settleOptions.trackTurnEndClock
+            ? ++this._nextCascadeSettleToken
+            : undefined;
+        if (settleToken !== undefined) {
+            this._turnEndCascadeSettleStarts.set(settleToken, Date.now());
+        }
+        try {
+            // Track per-promise settlement so promises still in flight at the cap can be
+            // carried over. A settled entry records its run; an unsettled one is re-parked.
+            const tracked = pending.map((p) => {
+                const entry = { done: false, promise: p };
+                entry.promise = p.then((run) => {
+                    entry.done = true;
+                    entry.run = run;
+                    return run;
+                });
+                return entry;
             });
-            return entry;
-        });
-        const timeout = new Promise((resolve) => {
-            setTimeout(resolve, maxWaitMs).unref?.();
-        });
-        await Promise.race([
-            Promise.allSettled(tracked.map((t) => t.promise)),
-            timeout,
-        ]);
-        let settled = 0;
-        let timedOut = 0;
-        for (const entry of tracked) {
-            if (entry.done && entry.run) {
-                this.appendCascadeRun(entry.run);
-                settled += 1;
+            const timeout = new Promise((resolve) => {
+                setTimeout(resolve, maxWaitMs).unref?.();
+            });
+            await Promise.race([
+                Promise.allSettled(tracked.map((t) => t.promise)),
+                timeout,
+            ]);
+            let settled = 0;
+            let timedOut = 0;
+            for (const entry of tracked) {
+                if (entry.done && entry.run) {
+                    this.appendCascadeRun(entry.run);
+                    settled += 1;
+                }
+                else {
+                    this._pendingCascadeRuns.push(entry.promise);
+                    timedOut += 1;
+                }
             }
-            else {
-                this._pendingCascadeRuns.push(entry.promise);
-                timedOut += 1;
+            return { settled, timedOut };
+        }
+        finally {
+            if (settleToken !== undefined) {
+                this._turnEndCascadeSettleStarts.delete(settleToken);
             }
         }
-        return { settled, timedOut };
     }
     consumeCascadeRuns() {
         const runs = this._cascadeRuns;
         this._cascadeRuns = [];
         return runs;
     }
-    recordInlineBlockers(filePath, summary) {
+    /**
+     * R1 (#1443 follow-up): non-destructive peek used by turn_end's read-only
+     * fast path. A carried cascade run (or one still in flight) represents a
+     * DELIVERY OPPORTUNITY, not turn activity — an agent that answers a question
+     * without editing anything must still get yesterday's late finding. Before
+     * this, the files-empty early return skipped `settleCascadeRuns` /
+     * `consumeCascadeRuns` entirely on a read-only turn, so `beginTurn`'s next
+     * carry pass saw the run as having survived a turn_start with no offsetting
+     * drain and dropped it — burning the one-turn carry allowance on a turn that
+     * never had a chance to deliver.
+     */
+    hasCascadeRuns() {
+        // Carried, ALREADY-BUILT runs only. Pending (still-settling) computes are
+        // deliberately excluded: a read-only turn that fell through for a pending
+        // run would block on the full settle cap — every turn, forever, when the
+        // compute never resolves (re-review finding F1). A pending run loses
+        // nothing by waiting: settleCascadeRuns re-parks it and the next turn
+        // that actually settles it delivers it.
+        return this._cascadeRuns.length > 0;
+    }
+    recordInlineBlockers(filePath, summary, writeIndex, sources, lines) {
         this._pendingInlineBlockers.set(path.resolve(filePath), {
             filePath,
             summary,
+            writeIndex,
+            sources,
+            lines,
+            recordedAtMs: Date.now(),
+            stale: false,
         });
     }
     clearInlineBlockers(filePath) {
         this._pendingInlineBlockers.delete(path.resolve(filePath));
     }
+    /**
+     * #1631: demote a cached blocker to stale without dropping it (#1419
+     * demote-not-drop). Called by the turn-boundary freshness sweep when the
+     * file or one of its forward imports drifted on disk after the verdict.
+     * Idempotent: re-marking an already-stale entry (for ANY reason) is a
+     * no-op — a `"past-eof"` demotion already took this record out of the
+     * authoritative channel, and `sweepInlineBlockerFreshness` re-checks next
+     * turn once that heals. Returns true only when this call transitioned the
+     * entry to stale, so a caller can log the demotion exactly once.
+     */
+    markInlineBlockerStale(filePath, reason = "dependency-drift") {
+        const key = path.resolve(filePath);
+        const existing = this._pendingInlineBlockers.get(key);
+        if (!existing || existing.stale)
+            return false;
+        this._pendingInlineBlockers.set(key, {
+            ...existing,
+            stale: true,
+            staleReason: reason,
+        });
+        return true;
+    }
+    /**
+     * #1641: re-derive the past-EOF demotion for one inline-blocker record.
+     * Unlike {@link markInlineBlockerStale} (a one-way latch for the
+     * dependency-drift gate), this RE-ARMS: called every turn end with the
+     * gate's freshly-computed verdict, it can both demote (rising edge) and
+     * heal (falling edge — a transient shrink-then-restore of the file). Never
+     * touches a record a sibling gate demoted (`staleReason !== "past-eof"`
+     * while `stale`) — composing with #1631's dependency-drift gate means each
+     * gate only heals its own demotions. Returns true only on an actual
+     * transition, so the caller logs/resyncs exactly once per edge.
+     */
+    setInlineBlockerPastEofStale(filePath, isPastEof) {
+        const key = path.resolve(filePath);
+        const existing = this._pendingInlineBlockers.get(key);
+        if (!existing)
+            return false;
+        if (existing.stale && existing.staleReason !== "past-eof")
+            return false;
+        const currentlyPastEof = !!existing.stale && existing.staleReason === "past-eof";
+        if (currentlyPastEof === isPastEof)
+            return false;
+        this._pendingInlineBlockers.set(key, {
+            ...existing,
+            stale: isPastEof,
+            staleReason: isPastEof ? "past-eof" : undefined,
+        });
+        return true;
+    }
+    /**
+     * Retire a file's inline blocker because a FRESH, content-bound diagnostic
+     * verdict proved it gone (#1561).
+     *
+     * The map was invalidated by exactly two events: a later dispatch of the
+     * SAME path returning no blockers, and that path ceasing to exist (#1245).
+     * Neither covers the common case that produced #1561 — a blocker on file F
+     * whose cause lives in file G. Fixing G re-dispatches G, not F, so F's
+     * verdict was never re-taken and "Unresolved from this turn" was re-injected
+     * for the rest of the session. In the live case the agent then ran
+     * `lsp_diagnostics` on F, pi-lens answered "confirmed clean", and the
+     * blocker was STILL re-served on the next three turn ends: #571 wired that
+     * tool's confirmed result into the widget footer and stopped there.
+     *
+     * This is the seam #1198 invariant 4 left undecided, decided: an affirmative
+     * clean from the authoritative current view retires the stale verdict.
+     *
+     * Ordering (#1198 invariants 1-2). Both stores draw from the same
+     * `nextWriteIndex()` counter, so when both sides are stamped the retire
+     * requires the clean verdict to be strictly NEWER. A slow old clean that
+     * settles after a fresh dispatch found real blockers must not erase them.
+     * When either side is unstamped the two cannot be ordered at all; the fresh
+     * confirmed verdict wins, because it is the only one of the two backed by an
+     * actual observation of current content. Only production's single record site
+     * is stamped, so in practice the unstamped branch is legacy callers/tests.
+     *
+     * COVERAGE (#1561 F1). A blocker is retired only by a verdict that can speak
+     * for the tools that raised it. Inline blockers come from the whole dispatch,
+     * not just the language server: `dispatcher.ts` collects every
+     * `semantic === "blocking"` diagnostic across all runners, so eslint,
+     * biome-check, actionlint, elixir/gleam-check and ast-grep security rules all
+     * land in this map. A language-server check knows nothing about any of them,
+     * so `coveredSources` must be a SUPERSET of the recorded sources or the entry
+     * stands. This is a commit gate: a record whose provenance is unknown (no
+     * `sources`) fails CLOSED and is never retired, because "we don't know what
+     * raised this" must not resolve to "an LSP check can clear it".
+     *
+     * @returns true when an entry was retired — the caller logs it, so an
+     * eviction is never silent (#1432 Gap 1).
+     */
+    retireInlineBlockerOnConfirmedClean(filePath, confirmedAtWriteIndex, coveredSources) {
+        const key = path.resolve(filePath);
+        const existing = this._pendingInlineBlockers.get(key);
+        if (!existing)
+            return false;
+        if (existing.writeIndex !== undefined &&
+            confirmedAtWriteIndex !== undefined &&
+            confirmedAtWriteIndex <= existing.writeIndex) {
+            return false;
+        }
+        // Fail closed on unknown provenance, and on any source the fresh verdict
+        // did not consult. An eslint-origin blocker outliving an LSP-only clean is
+        // the correct outcome — the next dispatch of that file is what clears it.
+        if (!existing.sources || existing.sources.length === 0)
+            return false;
+        const covered = new Set(coveredSources ?? []);
+        if (!existing.sources.every((source) => covered.has(source)))
+            return false;
+        this._pendingInlineBlockers.delete(key);
+        return true;
+    }
     reconcileInlineBlockers() {
         // Rebuild, never delete-in-place: `PathKeyedMap.delete()` re-normalizes
         // the key, and `normalizeMapKey` realpaths a live file but lowercases
@@ -462,7 +746,19 @@ export class RuntimeCoordinator {
         return this._complexityBaselines;
     }
     get fixedThisTurn() {
-        return this._fixedThisTurn;
+        // Self-referencing local so chained add() returns the same facade
+        // instead of re-entering this getter and allocating a new one per call
+        // (sonar S7725).
+        const facade = {
+            add: (filePath) => {
+                this._fixedThisTurn.set(filePath, true);
+                return facade;
+            },
+            has: (filePath) => this._fixedThisTurn.has(filePath),
+            delete: (filePath) => this._fixedThisTurn.delete(filePath),
+            clear: () => this._fixedThisTurn.clear(),
+        };
+        return facade;
     }
     get projectRulesScan() {
         return this._projectRulesScan;
@@ -475,39 +771,81 @@ export class RuntimeCoordinator {
         return this._readGuard;
     }
     /**
-     * Queue `filePath` for deferred formatting at `agent_end`. Returns `true`
-     * when this call created a NEW pending entry, `false` when it re-touched
-     * an already-queued file. #673: the caller uses this to publish
-     * `pilens:format:queued` only on first queue entry, so repeated edits to
-     * the same already-queued file before `agent_end` don't spam the bus.
+     * Record the canonical target `tool_call` resolved for `toolCallId`
+     * (#1642). The paired `tool_result` claims this exactly once via
+     * {@link takeToolCallAttribution} instead of re-deriving a path from its
+     * own diff metadata.
      */
-    deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId) {
+    recordToolCallAttribution(toolCallId, attribution) {
+        this._toolCallAttributions.set(toolCallId, {
+            ...attribution,
+            recordedAt: Date.now(),
+        });
+    }
+    /**
+     * One-shot claim of a previously recorded tool-call attribution. Removed
+     * on read: a given `tool_call`/`tool_result` pair correlates exactly once,
+     * and leaving it behind would let a later, unrelated `tool_result` that
+     * happens to reuse a stale id inherit a stranger's resolved path.
+     *
+     * An expired entry (older than `TOOL_CALL_ATTRIBUTION_TTL_MS`) is treated
+     * as a miss and removed rather than returned — see the constant's doc.
+     */
+    takeToolCallAttribution(toolCallId) {
+        const attribution = this._toolCallAttributions.get(toolCallId);
+        if (attribution === undefined)
+            return undefined;
+        this._toolCallAttributions.delete(toolCallId);
+        if (Date.now() - attribution.recordedAt > TOOL_CALL_ATTRIBUTION_TTL_MS) {
+            return undefined;
+        }
+        return attribution;
+    }
+    /**
+     * Queue one mutation kind for `filePath` at `agent_end`. Returns `true`
+     * when this call created a pending entry or added a new kind, and `false`
+     * for a same-kind re-touch. Callers publish each kind's first transition
+     * without spamming repeated edits before `agent_end`.
+     */
+    deferMutation(filePath, cwd, toolName, turnStateCwd, kind, ownerSessionId, originCwd) {
         const key = path.resolve(filePath);
         const now = Date.now();
-        const existing = this._pendingDeferredFormatFiles.get(key);
+        const resolvedOriginCwd = originCwd ?? turnStateCwd;
+        const existing = this._pendingDeferredMutations.get(key);
         if (existing) {
+            const addedKind = !existing.kinds.has(kind);
             existing.lastTouchedAt = now;
             existing.cwd = cwd;
             existing.turnStateCwd = turnStateCwd;
             existing.toolNames.add(toolName);
+            existing.kinds.add(kind);
             existing.queuedTurnIndex = this._turnIndex;
             existing.ownerSessionId = ownerSessionId;
-            return false;
+            existing.originCwd = resolvedOriginCwd;
+            return addedKind;
         }
-        this._pendingDeferredFormatFiles.set(key, {
+        this._pendingDeferredMutations.set(key, {
             filePath: key,
             cwd,
             turnStateCwd,
             firstTouchedAt: now,
             lastTouchedAt: now,
             toolNames: new Set([toolName]),
+            kinds: new Set([kind]),
             queuedTurnIndex: this._turnIndex,
             ownerSessionId,
+            originCwd: resolvedOriginCwd,
         });
         return true;
     }
+    deferFormat(filePath, cwd, toolName, turnStateCwd, ownerSessionId, originCwd) {
+        return this.deferMutation(filePath, cwd, toolName, turnStateCwd, "format", ownerSessionId, originCwd);
+    }
     get pendingDeferredFormatCount() {
-        return this._pendingDeferredFormatFiles.size;
+        return this._pendingDeferredMutations.size;
+    }
+    get pendingDeferredMutationCount() {
+        return this._pendingDeferredMutations.size;
     }
     /**
      * Legacy unconditional drain — still exposed for any caller that
@@ -515,8 +853,8 @@ export class RuntimeCoordinator {
      * flush call sites should prefer {@link claimDeferredFormatFiles}.
      */
     consumeDeferredFormatFiles() {
-        const records = [...this._pendingDeferredFormatFiles.values()];
-        this._pendingDeferredFormatFiles.clear();
+        const records = [...this._pendingDeferredMutations.values()];
+        this._pendingDeferredMutations.clear();
         return records;
     }
     /**
@@ -528,46 +866,92 @@ export class RuntimeCoordinator {
      *  - otherwise (both known, and they differ) the record belongs to a
      *    DIFFERENT session (e.g. a concurrent in-process secondary/subagent)
      *    and is left queued for its owner's own flush — UNLESS it has sat
-     *    unclaimed longer than `staleAfterMs` (the owner presumably died),
-     *    in which case this flush claims it anyway as an orphan-recovery
-     *    fallback.
+     *    unclaimed longer than `staleAfterMs` (the owner presumably died), in
+     *    which case this flush claims it as an orphan-recovery fallback ONLY
+     *    when `currentOriginCwd` (this flush's own workspace/worktree) exactly
+     *    matches the record's `originCwd` (the cwd it was actually queued
+     *    under, #1642 F3 — NOT `turnStateCwd`, which is always the workspace
+     *    root by design and so would match every session unconditionally). A
+     *    mismatch means the record belongs to a DIFFERENT checkout/worktree
+     *    than the one now running `agent_end` — claiming it across that
+     *    boundary is exactly how a worktree's queued edit got formatted onto
+     *    the parent checkout in the reported incident. It is left queued
+     *    (NOT deleted) and logged instead: a legitimate crashed-session
+     *    orphan from, say, a monorepo subdir must still be claimable later by
+     *    a flush whose origin actually matches, or stay visible for
+     *    observability — deleting it here would drop it forever with no
+     *    origin ever able to reclaim it.
      *
-     * Returns both the claimed records and, per skipped record, why it was
-     * left behind — callers use this for `agent_end`'s latency-log
-     * provenance and for the "stale fallback fired" log line.
+     * Returns the claimed records, the left-queued mismatched-origin records,
+     * and per-skipped record why it was left behind — callers use this for
+     * `agent_end`'s latency-log provenance and for the "stale fallback
+     * fired"/"orphan mismatch" log lines.
      */
-    claimDeferredFormatFiles(currentSessionId, now, staleAfterMs) {
+    claimDeferredFormatFiles(currentSessionId, now, staleAfterMs, currentOriginCwd) {
         const claimed = [];
         const staleClaimed = [];
         const deferredToOwner = [];
-        for (const [key, record] of this._pendingDeferredFormatFiles) {
+        const droppedOrphans = [];
+        for (const [key, record] of this._pendingDeferredMutations) {
             const sameSession = record.ownerSessionId === undefined ||
                 currentSessionId === undefined ||
                 record.ownerSessionId === currentSessionId;
             if (sameSession) {
                 claimed.push(record);
-                this._pendingDeferredFormatFiles.delete(key);
+                this._pendingDeferredMutations.delete(key);
                 continue;
             }
             const age = now - record.lastTouchedAt;
             if (age > staleAfterMs) {
-                staleClaimed.push(record);
-                this._pendingDeferredFormatFiles.delete(key);
+                // #1642 F3: origin identity is required before an orphan-recovery
+                // claim, not just staleness. `currentOriginCwd === undefined`
+                // means the caller can't state its own origin — fail-safe as
+                // "can't prove different" (same posture as the sameSession check
+                // above), not as a free pass to claim across a KNOWN mismatch.
+                const originMatches = currentOriginCwd === undefined ||
+                    pathsEqual(record.originCwd, currentOriginCwd);
+                if (originMatches) {
+                    this._pendingDeferredMutations.delete(key);
+                    staleClaimed.push(record);
+                }
+                else {
+                    // Left queued — see the doc above for why this must not be
+                    // deleted. Reported once per claim attempt; a genuinely
+                    // abandoned origin will keep surfacing here, which is the
+                    // intended, safer trade-off over silent, permanent loss.
+                    droppedOrphans.push(record);
+                }
                 continue;
             }
             deferredToOwner.push(record);
         }
-        return { claimed, staleClaimed, deferredToOwner };
+        return { claimed, staleClaimed, deferredToOwner, droppedOrphans };
     }
     /** Return claimed records that were never started by an aborted drain. */
     requeueDeferredFormatFiles(records) {
         for (const record of records) {
             const key = path.resolve(record.filePath);
-            if (!this._pendingDeferredFormatFiles.has(key)) {
-                this._pendingDeferredFormatFiles.set(key, record);
+            const existing = this._pendingDeferredMutations.get(key);
+            if (existing) {
+                for (const kind of record.kinds)
+                    existing.kinds.add(kind);
+                for (const toolName of record.toolNames)
+                    existing.toolNames.add(toolName);
+                continue;
             }
+            this._pendingDeferredMutations.set(key, {
+                ...record,
+                kinds: new Set(record.kinds),
+                toolNames: new Set(record.toolNames),
+            });
         }
     }
+    claimDeferredMutations(currentSessionId, now, staleAfterMs, currentOriginCwd) {
+        return this.claimDeferredFormatFiles(currentSessionId, now, staleAfterMs, currentOriginCwd);
+    }
+    requeueDeferredMutations(records) {
+        this.requeueDeferredFormatFiles(records);
+    }
     shouldWarmLspOnRead(filePath, maxAgeMs = 120_000) {
         const state = this._lspReadWarmState.get(path.resolve(filePath));
         if (!state)
@@ -592,3 +976,30 @@ export class RuntimeCoordinator {
         this._lspReadWarmState.delete(path.resolve(filePath));
     }
 }
+/**
+ * Read the live model identity off a pi extension context (#1655 item 2).
+ *
+ * `ExtensionContext.model` is `AgentSession.model`, projected through a lazy
+ * getter guarded by `assertActive()`
+ * (`@earendil-works/pi-coding-agent/dist/core/extensions/runner.js:488-491`;
+ * `dist/core/agent-session.js:580-582`). The value is a `Model` with `id` and
+ * `provider` (`@earendil-works/pi-ai/dist/types.d.ts:661-667`), or `undefined`
+ * when no model is selected.
+ *
+ * Because the getter is lazy and guarded, reading it on a REPLACED runner
+ * throws. Telemetry identity is advisory; a stale ctx must degrade to "no
+ * identity", never take down the event handler that happened to carry it.
+ */
+export function readHostModelIdentity(ctx) {
+    try {
+        const model = ctx
+            ?.model;
+        return {
+            model: typeof model?.id === "string" ? model.id : undefined,
+            provider: typeof model?.provider === "string" ? model.provider : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}