@herbertgao/pi-extensions 2026.8.5 → 2026.8.7

package/node_modules/pi-lens/dist/clients/runtime-turn.js

@@ -3,23 +3,93 @@ import { appendActionableWarningsHistory, buildActionableWarningsReport, formatA
 import { logActionableWarningsEvent } from "./actionable-warnings-logger.js";
 import { appendCodeQualityWarningsHistory, buildCodeQualityWarningsReport, formatCodeQualityWarningsAdvisory, writeCodeQualityWarningsReport, } from "./code-quality-warnings.js";
 import { clearGitGuardTestFailure, mergeGitGuardTestFailure, writeGitGuardRecord, } from "./git-guard.js";
+import { cascadeSettleWaitMs } from "./cascade-budget.js";
 import { logCascade } from "./cascade-logger.js";
 import { normalizeMapKey } from "./path-utils.js";
 import { resolveRunnerPath, toRunnerDisplayPath, } from "./dispatch/runner-context.js";
 import { getKnipIgnorePatterns } from "./file-utils.js";
+import { formatCacheAgeLabel } from "./finding-delivery-gate.js";
+import { getFullScanWallClockMs, isWorkspaceSweepActive, runWhenWorkspaceSweepIdle, SWEEP_IDLE_SAFETY_MARGIN_MS, } from "./lsp/workspace-sweep-hold.js";
 import { isTestRoleCollateral } from "./collateral-test-role.js";
 import { dedupeSecretFindings, fromAstGrepWarnings, fromGitleaks, fromTrivySecrets, isSecretWarning, secretLocationKey, } from "./secret-findings.js";
-import { formatDeadCodeAdvisory } from "./dead-code-client.js";
+import { deadCodeIssueKey, deadCodeIssues, formatDeadCodeDelta, stableFindingKey, } from "./dead-code-client.js";
+import { logDeadCodeScan } from "./dead-code-logger.js";
 import { PROJECT_DIAGNOSTICS_CACHE_VERSION, writeProjectDiagnosticsDeltaReport, } from "./project-diagnostics/cache.js";
+import { deadCodeIssueToProjectDiagnostic } from "./project-diagnostics/runner-adapters/dead-code.js";
+import { gitleaksFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/gitleaks.js";
+import { govulncheckFindingToProjectDiagnostic } from "./project-diagnostics/runner-adapters/govulncheck.js";
+import { trivyFindingToProjectDiagnostic, trivySecretFindingToProjectDiagnostic, } from "./project-diagnostics/runner-adapters/trivy.js";
 import { knipIssuesToProjectDiagnostics } from "./project-diagnostics/runner-adapters/knip.js";
+import { applyDispositionsMultiFile } from "./diagnostic-dispositions.js";
 import { logLatency } from "./latency-logger.js";
 import { getLspBudgetIdleTimeoutMs, shouldShortenLspIdleTimeout, } from "./lsp-budget.js";
 import { updateHeartbeat } from "./instance-registry.js";
 import { emitLensTurnFindings } from "./lens-events.js";
 import { RUNTIME_CONFIG } from "./runtime-config.js";
 import { isSubagentSession } from "./subagent-mode.js";
+import { formatRunDurationMs } from "./run-duration.js";
+import { MAX_ADVISORY_AFFECTED_FILES, gateFindingsByPathFreshness, snapshotAdvisoryProvenance, } from "./advisory-provenance.js";
+import { sweepInlineBlockerFreshness } from "./blocker-freshness.js";
+import { sweepInlineBlockerPastEof } from "./blocker-past-eof.js";
+// #1631 review V2: moved to its own leaf module so a low-level store
+// (widget-state.ts) can use the marker without importing this orchestrator —
+// see clients/stale-marker.ts's doc comment.
+import { STALE_LINE_MARKER } from "./stale-marker.js";
+import { getWidgetBlockingFilesForSweep, markWidgetFileBlockersStale, } from "./widget-state.js";
+/**
+ * #1617: turn_end reads gitleaks/govulncheck/trivy straight from their
+ * session-scan caches and formats them into advisory/blocker text — a
+ * reporting lane parallel to (and, before this fix, entirely bypassing)
+ * `dispatcher.ts:924`'s `applyDispositions` filter. An agent-marked
+ * false-positive/won't-fix on one of these findings never suppressed it
+ * here, so it re-reported on every turn.
+ *
+ * Filters `findings` through the SAME anchor derivation the dispatch path
+ * and `lens_diagnostics mode=full` use (`applyDispositionsMultiFile` in
+ * `diagnostic-dispositions.ts`), keyed off each lane's own canonical
+ * `ProjectDiagnostic` adapter (`toDiagnostic`) — the exact tool/rule/message
+ * identity `lens_diagnostics` already surfaces and `lens_diagnostic_mark`
+ * already anchors a mark against, not a second, cloned identity that would
+ * silently diverge from what the agent actually marked.
+ *
+ * Returns the surviving findings plus how many were dropped, so a caller can
+ * still surface a "suppressed by disposition: N" trace (the #1616
+ * suppressed-bucket rule — a security finding must never vanish with no
+ * trace, even when the disposition that dropped it is working as intended).
+ */
+function filterFindingsByDisposition(findings, cwd, toDiagnostic) {
+    if (findings.length === 0)
+        return { kept: findings, suppressed: 0 };
+    const candidates = findings.map((finding) => ({
+        finding,
+        diagnostic: toDiagnostic(finding),
+    }));
+    const survivors = new Set(applyDispositionsMultiFile(candidates.map((c) => c.diagnostic), cwd, (d) => d.filePath));
+    const kept = candidates
+        .filter((c) => survivors.has(c.diagnostic))
+        .map((c) => c.finding);
+    return { kept, suppressed: findings.length - kept.length };
+}
+/**
+ * Would writing `next` over `prev` throw away a good scan for a failed one?
+ *
+ * A failed run carries no findings. Writing it evicts the last good result, and
+ * every later reader then serves the failure as the answer — a 194-byte "not
+ * available" record replaced 149 KB of real findings in every dogfood project
+ * (#925, #1467). Callers keep the previous cache when this returns true.
+ */
+function wouldPoisonCache(prev, next) {
+    return !next.success && prev?.data.success === true;
+}
 // LSP idle reset scheduling — prevents thrashing by delaying shutdown
 let lspIdleResetTimeout = null;
+// #1618: set while this timer's fire is deferred behind an in-flight
+// workspace sweep (see `scheduleLSPIdleReset`'s `isWorkspaceSweepActive`
+// branch). `cancelLSPIdleReset` must be able to cancel THIS too — otherwise
+// an active-editing turn that cancels idle reset while a sweep is still
+// running would have it silently resurrected once the sweep finishes, even
+// though the session is no longer idle.
+let pendingSweepRearm = null;
 function emitIdleResetReporterWarning(reportErr) {
     try {
         process.emitWarning(`pi-lens LSP idle reset error reporter failed: ${reportErr}`, { code: "PI_LENS_LSP_IDLE_RESET_REPORTER_FAILED" });
@@ -38,12 +108,40 @@ function reportIdleResetError(onError, err) {
     }
 }
 function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
-    // Clear any pending reset to avoid multiple timers
+    // Clear any pending reset to avoid multiple timers. #1618: also cancel a
+    // rearm still waiting on a prior sweep's hold — otherwise re-scheduling
+    // here (this call) leaves that OLD waiter armed too, and the sweep's
+    // eventual release would fire a SECOND, independent `scheduleLSPIdleReset`
+    // alongside this fresh one.
     if (lspIdleResetTimeout) {
         clearTimeout(lspIdleResetTimeout);
     }
+    if (pendingSweepRearm) {
+        pendingSweepRearm.cancelled = true;
+        pendingSweepRearm = null;
+    }
     lspIdleResetTimeout = setTimeout(() => {
         lspIdleResetTimeout = null;
+        // #1618: a full workspace sweep (`lens_diagnostics mode=full`) grants
+        // itself a wall-clock ceiling that can outlive this timer's delay — this
+        // used to fire straight into an in-flight sweep and destroy the very
+        // service the sweep was actively touching, mislabeling every file the
+        // sweep had not yet reached as budget exhaustion. Defer instead of
+        // firing: re-arm a FRESH `delayMs` timer once the sweep releases its
+        // hold, rather than resuming a countdown that's already elapsed (which
+        // would fire the instant the hold releases) or destroying mid-sweep.
+        if (isWorkspaceSweepActive()) {
+            const rearmToken = { cancelled: false };
+            pendingSweepRearm = rearmToken;
+            runWhenWorkspaceSweepIdle(() => {
+                if (rearmToken.cancelled)
+                    return;
+                if (pendingSweepRearm === rearmToken)
+                    pendingSweepRearm = null;
+                scheduleLSPIdleReset(resetFn, delayMs, options);
+            });
+            return;
+        }
         try {
             if (options.isCurrentSession && !options.isCurrentSession()) {
                 return;
@@ -62,17 +160,58 @@ function scheduleLSPIdleReset(resetFn, delayMs, options = {}) {
     // exit after completing its work, not wait 240 seconds for this to fire)
     lspIdleResetTimeout.unref();
 }
+// #1618 acceptance criterion 6: FULL_SCAN_WALL_CLOCK_MS (the full-sweep wall
+// clock ceiling, `tools/lens-diagnostics.ts`) must stay under EVERY idle
+// reset delay this module can arm — derived, not asserted, so the constants
+// can't drift back into a relationship where a still-running sweep can
+// outlive the timer. The AC1 hold above already makes a mid-sweep fire
+// impossible regardless of this margin; this is defense in depth against a
+// future caller that touches the LSP service outside
+// `runWorkspaceDiagnostics`' hold. `SWEEP_IDLE_SAFETY_MARGIN_MS` is
+// single-sourced from `workspace-sweep-hold.ts`, which also uses it for its
+// own max-hold-age failsafe — one tunable, not two.
+const DEFAULT_LSP_IDLE_RESET_MS = 240_000;
+function sweepDerivedFloorMs() {
+    return getFullScanWallClockMs() + SWEEP_IDLE_SAFETY_MARGIN_MS;
+}
+/** The normal (non-subagent, non-budget-pressured) idle-reset delay. */
+function getBaseLspIdleResetMs() {
+    return Math.max(DEFAULT_LSP_IDLE_RESET_MS, sweepDerivedFloorMs());
+}
+/**
+ * #1618 (R4): the subagent-light (#713) and cross-process-budget-pressured
+ * (#449) paths used to arm a flat, much SHORTER delay (60s default) than the
+ * sweep's own 300s ceiling — a 5:1 inversion covered only by the AC1 hold.
+ * Deriving this path too means AC6 ("the sweep's ceiling stays under every
+ * idle-reset delay") holds universally, not just for the common path, and an
+ * env override to either constant can never invert it (`Math.max` floors at
+ * the derived value no matter how small the override pushes the other side).
+ *
+ * Accepted cost (deliberate, not incidental — see R6 in the PR body): under
+ * default settings this now ALSO arms the ~360s derived floor rather than a
+ * true 60s teardown, trading some of #713's "release a short-lived
+ * subagent's fleet fast" benefit for AC6 holding without exceptions.
+ */
+function getShortenedLspIdleResetMs() {
+    return Math.max(getLspBudgetIdleTimeoutMs(), sweepDerivedFloorMs());
+}
+/** The idle-reset delay `handleTurnEnd` actually arms on a file-less turn —
+ *  exported so tests assert against the REAL computed value instead of a
+ *  hand-derived literal that can silently drift from this function. */
+export function getEffectiveLspIdleResetMs() {
+    return isSubagentSession() || shouldShortenLspIdleTimeout()
+        ? getShortenedLspIdleResetMs()
+        : getBaseLspIdleResetMs();
+}
 export function cancelLSPIdleReset() {
     if (lspIdleResetTimeout) {
         clearTimeout(lspIdleResetTimeout);
         lspIdleResetTimeout = null;
     }
-}
-// Bounded wait for the turn's deferred cascade computes (#450) to settle before
-// they are merged below. A late compute is carried over to the next turn_end.
-function cascadeSettleWaitMs() {
-    const raw = Number(process.env.PI_LENS_CASCADE_SETTLE_WAIT_MS);
-    return Number.isFinite(raw) && raw >= 0 ? raw : 5000;
+    if (pendingSweepRearm) {
+        pendingSweepRearm.cancelled = true;
+        pendingSweepRearm = null;
+    }
 }
 function capTurnEndMessage(content) {
     const maxLines = RUNTIME_CONFIG.turnEnd.maxLines;
@@ -132,7 +271,15 @@ export async function handleTurnEnd(deps) {
         turnState = cacheManager.readTurnState(cwd);
     }
     const files = Object.keys(turnState.files);
-    if (files.length === 0) {
+    // R1 (#1443 follow-up): a read-only turn (no files touched) must not take
+    // the fast idle-reset path while a carried cascade run — or one still
+    // settling — is waiting for its delivery opportunity. Falling through to
+    // the normal pipeline lets the settle/drain/merge logic below run exactly
+    // as it does for an edit turn, so a carried finding reaches the agent
+    // instead of dying unrendered. `hasCascadeRuns()` is a cheap peek (no
+    // pending work almost every turn), so the common read-only turn still
+    // takes the early return below.
+    if (files.length === 0 && !runtime.hasCascadeRuns()) {
         // A genuinely clean session must invalidate the persisted guard record.
         // Blocker records are retained only while the runtime still reports one.
         if (getFlag("lens-guard") && !runtime.gitGuardHasBlockers) {
@@ -142,14 +289,15 @@ export async function handleTurnEnd(deps) {
                 cacheManager.clearCache("turn-end-findings", cwd);
             }
         }
-        // #713: subagent sessions use a shorter idle reset (60s) — a short-lived
-        // task agent holding a warm fleet for 4 minutes after its last turn is
-        // pure waste under fan-out. Classify ONCE here so every tick in this call
-        // path shares the same answer. PI_LENS_SUBAGENT_FULL=1 restores 240s via
-        // isSubagentSession() returning false.
-        const idleResetMs = isSubagentSession() || shouldShortenLspIdleTimeout()
-            ? getLspBudgetIdleTimeoutMs()
-            : 240_000;
+        // #713: subagent sessions use a shorter idle reset (nominally 60s) — a
+        // short-lived task agent holding a warm fleet for 4 minutes after its
+        // last turn is pure waste under fan-out. Classify ONCE here so every
+        // tick in this call path shares the same answer. PI_LENS_SUBAGENT_FULL=1
+        // restores the base delay via isSubagentSession() returning false.
+        // #1618: both branches route through `getEffectiveLspIdleResetMs` so
+        // AC6's derivation applies universally — see that function's doc for
+        // why the "shorter" path is not always literally 60s anymore.
+        const idleResetMs = getEffectiveLspIdleResetMs();
         dbg(`turn_end: no modified files, scheduling LSP idle reset (${idleResetMs / 1000}s)`);
         if (!getFlag("no-lsp")) {
             const sessionGeneration = runtime.sessionGeneration;
@@ -161,8 +309,14 @@ export async function handleTurnEnd(deps) {
         resetFormatService();
         return;
     }
-    // Cancel any pending idle reset since we're actively working
-    if (lspIdleResetTimeout) {
+    // Cancel any pending idle reset since we're actively working. #1618: also
+    // checks `pendingSweepRearm` — a timer deferred behind an in-flight
+    // workspace sweep already nulled `lspIdleResetTimeout` (the setTimeout
+    // callback clears it before checking the hold), so this guard used to
+    // read "nothing pending" and skip the cancel while a rearm was still
+    // queued to fire the instant the sweep released its hold — resurrecting
+    // idle reset on a session that had since gone back to active editing.
+    if (lspIdleResetTimeout || pendingSweepRearm) {
         cancelLSPIdleReset();
         dbg("turn_end: cancelled pending LSP idle reset (active editing)");
     }
@@ -176,22 +330,91 @@ export async function handleTurnEnd(deps) {
     }
     const turnEndStart = Date.now();
     const blockerParts = [];
+    /**
+     * #1622 review M2: findings the freshness gate demoted. A third tier between
+     * blockers and advisories — not a blocker, because the cached coordinate is
+     * untrustworthy; not an advisory, because the advisory label reads "no action
+     * required this turn" and these DO require a re-scan. Each part carries its
+     * own imperative preamble rather than inheriting that label.
+     */
+    const staleSecretParts = [];
     const advisoryParts = [];
     const projectDiagnosticsDelta = [];
     const projectDiagnosticsSources = new Set();
+    // #1641: past-EOF gate. Runs BEFORE the dependency-drift sweep below — a
+    // cheap statSync per cited file is worth paying first so the pricier
+    // import-parsing sweep can skip anything already taken out of the
+    // authoritative channel this turn (see blocker-past-eof.ts's module doc
+    // for the full composition rule with #1631's gate).
+    const blockerPastEofStart = Date.now();
+    const blockerPastEof = sweepInlineBlockerPastEof(runtime, cwd);
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "blocker_past_eof_sweep",
+        durationMs: Date.now() - blockerPastEofStart,
+        metadata: {
+            total: blockerPastEof.total,
+            checked: blockerPastEof.checked,
+            demoted: blockerPastEof.demoted,
+            healed: blockerPastEof.healed,
+        },
+    });
+    // #1631: freshness gate. A cached blocker is a verdict about the file AND
+    // everything it imports; before re-serving it, sweep for out-of-band drift of
+    // the file or its forward imports and demote drifted entries to a
+    // `[stale — re-run to confirm]` advisory instead of re-asserting them at full
+    // authority (#1419 demote-not-drop).
+    const blockerFreshnessStart = Date.now();
+    // #1790: widen the sweep's population with widget-store rows a cache-served
+    // replay populated without ever touching RuntimeCoordinator's inline-blocker
+    // map — see blocker-freshness.ts's `WidgetSweepBlockerEntry` doc for why this
+    // is injected here rather than imported by blocker-freshness.ts itself.
+    const blockerFreshness = await sweepInlineBlockerFreshness(runtime, cwd, {
+        additionalEntries: getWidgetBlockingFilesForSweep().map((row) => ({
+            filePath: row.filePath,
+            recordedAtMs: row.recordedAtMs,
+            demote: () => markWidgetFileBlockersStale(row.filePath, "dependency-drift"),
+        })),
+    });
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "blocker_freshness_sweep",
+        durationMs: Date.now() - blockerFreshnessStart,
+        metadata: {
+            total: blockerFreshness.total,
+            kept: blockerFreshness.kept,
+            revalidated: blockerFreshness.revalidated,
+            alreadyStale: blockerFreshness.alreadyStale,
+            truncatedImports: blockerFreshness.truncatedImports,
+        },
+    });
     // Re-surface inline blockers from this turn that the agent didn't fix.
     // These were shown inline during write/edit but the agent moved on without resolving them.
     const unresolvedBlockers = runtime.getInlineBlockersSnapshot();
-    for (const { filePath: bPath, summary } of unresolvedBlockers) {
+    for (const { filePath: bPath, summary, stale } of unresolvedBlockers) {
         const displayPath = toRunnerDisplayPath(cwd, bPath);
-        blockerParts.push(`Unresolved from this turn — ${displayPath}:\n${summary}`);
+        if (stale) {
+            // #1631: demoted — out of the authoritative blocker channel and into the
+            // advisory channel with a stale marker, so the agent is told to re-run
+            // rather than pressured by a verdict that may already be resolved.
+            // @delivery-surface: runtime-turn:unresolved-inline-blocker
+            advisoryParts.push(`${STALE_LINE_MARKER} ${displayPath}:\n${summary}`);
+        }
+        else {
+            // @delivery-surface: runtime-turn:unresolved-inline-blocker
+            blockerParts.push(`Unresolved from this turn — ${displayPath}:\n${summary}`);
+        }
     }
     // Drain the deferred cascade computes kicked off this turn (#450). They ran
     // concurrently off the write hot path; wait a bounded time for them here so
     // their runs are available to the merge below. A compute still in flight at
     // the cap is carried over to the next turn_end (never dropped).
     const cascadeSettleStart = Date.now();
-    const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs());
+    const { settled, timedOut } = await runtime.settleCascadeRuns(cascadeSettleWaitMs(), { trackTurnEndClock: true });
     logLatency({
         type: "phase",
         toolName: "turn_end",
@@ -209,12 +432,72 @@ export async function handleTurnEnd(deps) {
     const cascadeRuns = runtime.consumeCascadeRuns().filter((run) => {
         const originSeq = run.origin?.projectSeq;
         const originTurn = run.origin?.turnSeq;
-        // A deferred result from before a later write/turn is not current state.
-        // Old test fixtures without provenance remain accepted for compatibility.
-        return ((originSeq === undefined || originSeq === runtime.projectSeq) &&
-            (originTurn === undefined || originTurn === runtime.turnIndex));
+        // A deferred result from AFTER a later write is not current state. Old test
+        // fixtures without provenance remain accepted for compatibility.
+        //
+        // #1443: `turnSeq` alone is NOT a supersede signal, and it used to be an
+        // unconditional reject. Every LATE run — one whose compute missed the
+        // settle cap and was re-parked by `settleCascadeRuns`, and one the
+        // quiet-window reconcile appended after this turn's predecessor already
+        // consumed (carried across turn_start by `beginTurn`) — is BY DEFINITION
+        // from an earlier turn, so `originTurn === runtime.turnIndex` was always
+        // false for exactly the runs the carry-over was built to preserve. Both
+        // producers' contracts were dead code: the measured cases were the two
+        // highest-fan-out cascades of the day (38 and 40 neighbours).
+        //
+        // R2 (#1443 follow-up): `projectSeq` alone is NOT a per-file supersede
+        // signal — it is GLOBAL, advancing on every pi-observed write anywhere in
+        // the project. Rejecting on any mismatch meant an edit to an unrelated
+        // file superseded a run that had nothing to do with it, reintroducing the
+        // exact 38/40-neighbour loss #1443 was written to fix, one filter down.
+        // `getFilesChangedSince` (#451) is the honest per-file signal: a run is
+        // superseded only if its own primary file or one of its neighbours was
+        // actually rewritten since it launched. A late-but-not-superseded run is
+        // surfaced; a superseded one is dropped with a RECORD (never silently),
+        // so the loss stays countable.
+        if (originSeq !== undefined) {
+            const changedSince = runtime.getFilesChangedSince(originSeq);
+            if (changedSince.length > 0) {
+                const changedSet = new Set(changedSince);
+                const primaryKey = normalizeMapKey(path.resolve(run.filePath));
+                const neighborKeys = [
+                    ...(run.result?.neighbors ?? []).map((n) => n.filePath),
+                    ...(run.selectedNeighborPaths ?? []),
+                ].map((filePath) => normalizeMapKey(path.resolve(filePath)));
+                const supersededByOwnFile = changedSet.has(primaryKey) ||
+                    neighborKeys.some((k) => changedSet.has(k));
+                if (supersededByOwnFile) {
+                    logCascade({
+                        phase: "cascade_carry_over_drop",
+                        filePath: run.filePath,
+                        neighborCount: run.neighborCount,
+                        diagnosticCount: run.diagnosticCount,
+                        reason: "superseded_by_later_write",
+                        metadata: {
+                            originProjectSeq: originSeq,
+                            projectSeq: runtime.projectSeq,
+                            originTurnSeq: originTurn,
+                            turnIndex: runtime.turnIndex,
+                            carriedTurns: run.carriedTurns,
+                            changedFiles: changedSince,
+                        },
+                    });
+                    return false;
+                }
+            }
+        }
+        return true;
     });
     const cascadeResults = cascadeRuns.flatMap((r) => r.result ? [r.result] : []);
+    // #1550 class sweep: every cascade record below summarises `cascadeResults`
+    // — runs, which carry their own paths and can be carried across turns
+    // (#1443) — so labelling them with the turn's first EDITED file is the same
+    // mis-attribution the `cascade_indeterminate` fix removes. On a read-only
+    // drain turn `files` is empty and the old `?? cwd` fallback stamped a bare
+    // DIRECTORY as the record's file. These three are turn-level AGGREGATES (no
+    // per-file cause is claimed), so one label suffices; the edited file and cwd
+    // stay as fallbacks.
+    const cascadeLogFilePath = cascadeResults[0]?.filePath ?? files[0] ?? cwd;
     if (cascadeResults.length > 0) {
         const seen = new Map();
         for (const result of cascadeResults) {
@@ -231,11 +514,25 @@ export async function handleTurnEnd(deps) {
             }
         }
         const parts = [];
+        // #1446 item 1: track what actually gets injected — a suppressed result
+        // (real formatted cascade text, but every one of its neighbors was claimed
+        // by a LATER result — see the reverse-iteration ownership pass above) was
+        // previously indistinguishable from "no output"; this counts it explicitly
+        // instead of letting it vanish.
+        let injectedNeighborCount = 0;
+        let injectedDiagnosticCount = 0;
+        let suppressedByOwnership = 0;
         for (const result of seen.values()) {
             const pk = normalizeMapKey(result.filePath);
             const ownsAny = result.neighbors.some((n) => neighborOwner.get(normalizeMapKey(n.filePath)) === pk);
-            if (ownsAny && result.formatted)
+            if (ownsAny && result.formatted) {
                 parts.push(result.formatted);
+                injectedNeighborCount += result.neighbors.length;
+                injectedDiagnosticCount += result.neighbors.reduce((s, n) => s + n.diagnostics.length, 0);
+            }
+            else if (!ownsAny && result.formatted) {
+                suppressedByOwnership++;
+            }
         }
         // Suggest tests for cascade neighbors (files with diagnostics)
         const neighborFilesWithErrors = cascadeResults
@@ -243,9 +540,27 @@ export async function handleTurnEnd(deps) {
             .filter((n) => n.diagnostics.length > 0)
             .map((n) => n.filePath);
         const uniqueNeighborFiles = [...new Set(neighborFilesWithErrors)];
+        let testSuggestionCount = 0;
         if (uniqueNeighborFiles.length > 0 &&
             typeof testRunnerClient.suggestTestFiles === "function") {
             const testSuggestions = testRunnerClient.suggestTestFiles(uniqueNeighborFiles, cwd);
+            testSuggestionCount = testSuggestions.length;
+            // #1446 item 2: this path previously emitted nothing to any log — a
+            // zero-suggestion outcome (neighbors had errors but no test file
+            // resolved for any of them) is the more interesting case, so it is
+            // recorded on the same phase rather than only logging on a hit.
+            logCascade({
+                phase: "cascade_test_targets",
+                filePath: cascadeLogFilePath,
+                neighborCount: uniqueNeighborFiles.length,
+                metadata: {
+                    neighborFiles: uniqueNeighborFiles.slice(0, 10),
+                    suggestedTestFiles: testSuggestions.slice(0, 10).map((s) => s.testFile),
+                    runner: testSuggestions[0]?.runner,
+                    truncated: testSuggestions.length > 10,
+                    zeroSuggestions: testSuggestions.length === 0,
+                },
+            });
             if (testSuggestions.length > 0) {
                 const testLines = testSuggestions
                     .slice(0, 5)
@@ -257,11 +572,34 @@ export async function handleTurnEnd(deps) {
                 parts.push(testSection);
             }
         }
-        if (parts.length > 0)
-            blockerParts.push(parts.join("\n\n"));
+        if (parts.length > 0) {
+            const section = parts.join("\n\n");
+            // @delivery-surface: runtime-turn:cascade-blocker
+            blockerParts.push(section);
+            // #1446 item 1: proves the cascade section reached `blockerParts` —
+            // i.e. it was QUEUED for persistence into the turn-end advisory — not
+            // that it reached the agent. The counters alone (cascade_result,
+            // cascade_turn_end) never confirmed even that much, only computation.
+            // Actual delivery happens later, via consumeTurnEndFindings/
+            // peekTurnEndFindings, and can still be suppressed after this point
+            // (e.g. allFilesDeleted, cross-turn dedup, or the session ending
+            // before the next turn_end drains it) — this record does not prove
+            // the agent ever saw the text.
+            logCascade({
+                phase: "cascade_injected",
+                filePath: cascadeLogFilePath,
+                neighborCount: injectedNeighborCount,
+                diagnosticCount: injectedDiagnosticCount,
+                metadata: {
+                    sectionChars: section.length,
+                    testSuggestionCount,
+                    suppressedByOwnership,
+                },
+            });
+        }
         logCascade({
             phase: "cascade_turn_end",
-            filePath: files[0] ?? cwd,
+            filePath: cascadeLogFilePath,
             neighborCount: cascadeResults.reduce((s, r) => s + r.neighbors.length, 0),
             diagnosticCount: cascadeResults.reduce((s, r) => s + r.neighbors.reduce((ns, n) => ns + n.diagnostics.length, 0), 0),
             metadata: {
@@ -271,8 +609,9 @@ export async function handleTurnEnd(deps) {
         });
     }
     // #1023: surface an HONEST note whenever a cascade run could not compute
-    // downstream impact (degraded/over-cap graph, missing node, or a thrown
-    // compute) — never a silent all-clear (#533). This goes to the ADVISORY tier,
+    // downstream impact (degraded/over-cap graph, missing node, a thrown compute,
+    // or a deliberately budget-truncated neighbor set) — never a silent all-clear
+    // (#533). This goes to the ADVISORY tier,
     // NOT the blocker tier: in an over-cap monorepo the graph is `skipped` on
     // every edit, so a blocker would fire hard and never clear turn state every
     // turn (over-escalation — the mirror of the silent-all-clear bug). Advisory
@@ -309,12 +648,28 @@ export async function handleTurnEnd(deps) {
                 const more = files.length > 5 ? ` (+${files.length - 5} more)` : "";
                 lines.push(`  • ${detail}: ${shown}${more}`);
             }
-            const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath))).size;
+            const fileCount = new Set(runs.map((r) => normalizeMapKey(r.filePath)))
+                .size;
             const reasons = [...byDetail.keys()].join("; ");
             return `${frame.lead(fileCount, reasons)}\n${lines.join("\n")}`;
         };
-        const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected");
-        const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected");
+        // #1445: `excluded_by_role` (test files excluded from the graph BY DESIGN,
+        // #260) is never agent-facing — it is not a graph failure, and #1080
+        // already excludes test-role files from every neighbor surface, so "a
+        // clean result does not cover them" would itself be a false claim. It
+        // stays visible in the `cascade_indeterminate` log below (metadata-only,
+        // info-level) so the log can tell an intentional exclusion from a real
+        // graph gap, but it never reaches `buildAdvisory`/the agent.
+        const graphRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason !== "lsp_binding_rejected" &&
+            r.indeterminate?.reason !== "excluded_by_role" &&
+            r.indeterminate?.reason !== "budget_truncated" &&
+            r.indeterminate?.budget === undefined);
+        const bindingRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "lsp_binding_rejected" &&
+            r.indeterminate?.budget === undefined);
+        // Budget coverage can be merged into a graph or binding marker, so its
+        // advisory bucket follows the evidence rather than replacing that reason.
+        const budgetRuns = indeterminateRuns.filter((r) => r.indeterminate?.reason === "budget_truncated" ||
+            r.indeterminate?.budget !== undefined);
         // Factual/informational phrasing — the advisory tier wraps this with an
         // "ℹ️ Advisory — no action required this turn:" label, so an imperative
         // ("review dependents manually") would contradict it. The #533 substance
@@ -327,6 +682,7 @@ export async function handleTurnEnd(deps) {
                 ? "changed file not in the review graph"
                 : "review graph unavailable",
         });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
         if (graphAdvisory)
             advisoryParts.push(graphAdvisory);
         const bindingAdvisory = buildAdvisory(bindingRuns, {
@@ -335,15 +691,57 @@ export async function handleTurnEnd(deps) {
                 `cascade result does not cover them.`,
             fallbackDetail: () => "cascade diagnostics withheld (binding rejected)",
         });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
         if (bindingAdvisory)
             advisoryParts.push(bindingAdvisory);
+        const budgetAdvisory = buildAdvisory(budgetRuns, {
+            lead: (fileCount, reasons) => `Cascade checked the selected neighbors for ${fileCount} edited file(s) this turn, ` +
+                `but some eligible dependents were not checked because the cascade budget ` +
+                `was exhausted (${reasons}); a clean cascade result does not cover them.`,
+            fallbackDetail: (r) => {
+                const budget = r.indeterminate?.budget;
+                if (!budget)
+                    return "cascade budget omitted eligible dependents";
+                const detail = `cascade budget checked ${budget.selectedCount} of ${budget.eligibleCount} eligible dependents (${budget.truncatedCount} omitted)`;
+                return budget.transitiveTruncated
+                    ? `${detail}; transitive expansion was capped before all eligible dependents were enumerated`
+                    : detail;
+            },
+        });
+        // @delivery-surface: runtime-turn:cascade-coverage-advisory
+        if (budgetAdvisory)
+            advisoryParts.push(budgetAdvisory);
         const fileCount = new Set(indeterminateRuns.map((r) => normalizeMapKey(r.filePath))).size;
+        // #1550: attribute each reason to the file that PRODUCED it. This record
+        // used to stamp `filePath: files[0] ?? cwd` — the turn's first EDITED file
+        // — and a bare `reasons` array with no file association. The two sets are
+        // disjoint: a run can be carried across turns (#1443), and an edited file
+        // can skip the graph entirely (markdown/JSON return `non_code` before
+        // computeImpactCascade ever runs). So the log blamed a file that could not
+        // have produced the reason — a markdown file credited with `missing_node`,
+        // a non-test source file credited with `excluded_by_role` — and the defect
+        // read as "concentrated on test files" only because the first edited file
+        // of a turn usually is one. `fileCount` and the agent-facing advisory
+        // already keyed off `r.filePath`; only this record's labels did not.
+        const byFile = indeterminateRuns.map((r) => ({
+            file: toRunnerDisplayPath(cwd, r.filePath),
+            reason: r.indeterminate?.reason,
+            ...(r.indeterminate?.detail && { detail: r.indeterminate.detail }),
+            ...(r.indeterminate?.budget && { budget: r.indeterminate.budget }),
+            ...(r.indeterminate?.diagnostic && {
+                diagnostic: r.indeterminate.diagnostic,
+            }),
+        }));
         logCascade({
             phase: "cascade_indeterminate",
-            filePath: files[0] ?? cwd,
+            // The first indeterminate run's own file. `files[0] ?? cwd` survives only
+            // as a last resort for a run with no path at all.
+            filePath: indeterminateRuns[0]?.filePath ?? files[0] ?? cwd,
             metadata: {
                 fileCount,
                 reasons: indeterminateRuns.map((r) => r.indeterminate?.reason),
+                byFile: byFile.slice(0, 20),
+                ...(byFile.length > 20 && { byFileTruncated: byFile.length - 20 }),
             },
         });
     }
@@ -385,25 +783,44 @@ export async function handleTurnEnd(deps) {
         // run tool checks every turn. Also back off after a timeout/kill so every
         // agent turn does not spend 30s launching another heavyweight knip process.
         const prevKnip = cacheManager.readCache("knip", cwd);
+        // An availability failure is NOT a hard knip failure: knip never ran, so
+        // there is nothing to back off from, and backing off would make an
+        // expiring probe verdict permanent again (#1467).
         const previousFailedHard = prevKnip &&
             !prevKnip.data.success &&
+            !prevKnip.data.failureKind &&
             /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prevKnip.data.summary);
         if (previousFailedHard) {
             dbg(`turn_end: skipping knip after recent failure: ${prevKnip.data.summary}`);
             knipMeta = { skipped: true, reason: prevKnip.data.summary };
         }
         else {
-            const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns());
-            cacheManager.writeCache("knip", knipResult, cwd);
+            const knipResult = await knipClient.analyze(cwd, getKnipIgnorePatterns(), {
+                projectSeq: runtime.projectSeq,
+            });
+            // Never overwrite a good scan with a failure (#925, #1467): the last
+            // good result stays until a new successful scan replaces it.
+            const knipWouldPoison = wouldPoisonCache(prevKnip, knipResult);
+            if (knipWouldPoison) {
+                dbg(`turn_end: keeping last good knip cache; this run failed: ${knipResult.summary}`);
+            }
+            else {
+                cacheManager.writeCache("knip", knipResult, cwd);
+            }
             knipMeta = {
+                execution: knipResult.execution ?? "executed",
                 success: knipResult.success,
                 totalIssues: knipResult.issues.length,
                 newIssues: 0,
                 blockerIssues: 0,
                 ...(!knipResult.success && { reason: knipResult.summary }),
+                ...(knipResult.failureKind && { failureKind: knipResult.failureKind }),
+                ...(knipWouldPoison && { cacheKept: true }),
             };
             if (knipResult.success && knipResult.issues.length > 0) {
-                const issueKey = (i) => `${i.type}:${i.file ?? ""}:${i.name}:${i.line ?? 0}:${i.package ?? ""}`;
+                // Deliberately excludes the line number — see stableFindingKey's
+                // doc comment (#1483: mirrors the dead-code fix in #1477).
+                const issueKey = (i) => stableFindingKey(i.type, i.file, i.name, i.package);
                 const prevKeys = new Set((prevKnip?.data?.issues ?? []).map(issueKey));
                 const modifiedSet = new Set(files.map((f) => resolveRunnerPath(cwd, f)));
                 const newIssues = knipResult.issues.filter((issue) => {
@@ -435,6 +852,7 @@ export async function handleTurnEnd(deps) {
                     if (firstPath) {
                         report += `  First location: ${firstPath}\n`;
                     }
+                    // @delivery-surface: runtime-turn:knip-blocker
                     blockerParts.push(report);
                 }
                 // Turn-end injects only this turn's HIGH-CONFIDENCE, ATTRIBUTABLE
@@ -454,6 +872,7 @@ export async function handleTurnEnd(deps) {
                             : "(unknown)";
                         report += `  ${display}${issue.line ? `:${issue.line}` : ""} — ${issue.name}\n`;
                     }
+                    // @delivery-surface: runtime-turn:knip-advisory
                     advisoryParts.push(report);
                 }
             }
@@ -467,25 +886,206 @@ export async function handleTurnEnd(deps) {
         durationMs: Date.now() - t2,
         metadata: knipMeta,
     });
+    // Cross-file dead-code (#127) for non-JS/TS languages, on knip's contract:
+    // re-scan only when this turn touched a file the client owns, then inject the
+    // ATTRIBUTABLE delta — symbols in those files that became unused because of
+    // the edit. The project-wide list is deliberately NOT injected per turn (the
+    // same reasoning as knip above) and stays available via lens_diagnostics.
+    // MUST run before the projectDiagnosticsDelta write below, or a dead-code-only
+    // turn would persist nothing.
+    const tDeadCode = Date.now();
+    const deadCodeMeta = {};
+    if (runtime.isStartupScanInFlight("dead-code")) {
+        dbg("turn_end: skipping dead-code (startup scan still in flight)");
+        deadCodeMeta.skipped = true;
+        deadCodeMeta.reason = "startup_scan_in_flight";
+    }
+    else if (deadCodeClients.length === 0) {
+        deadCodeMeta.reason = "no_clients";
+    }
+    else {
+        // The modified-file set costs a resolveRunnerPath per file, and that walks
+        // every ancestor to the filesystem root on a miss. Build it lazily, only
+        // once a client has actually claimed this project, so an all-JS repo with
+        // no dead-code client pays nothing per turn. Knip does the same.
+        let modifiedSet = null;
+        const modifiedFiles = () => (modifiedSet ??= new Set(files.map((f) => resolveRunnerPath(cwd, f))));
+        let newIssueTotal = 0;
+        const reasons = [];
+        // A malformed client or deps object must never abort turn_end. Before the
+        // per-turn delta this block only read a cache; now it iterates and awaits,
+        // so the whole thing needs the guard, not just `client.analyze`.
+        try {
+            for (const client of deadCodeClients) {
+                if (!client.detect(cwd)) {
+                    reasons.push(`${client.id}:not_detected`);
+                    continue;
+                }
+                if (![...modifiedFiles()].some((f) => client.owns(f))) {
+                    reasons.push(`${client.id}:no_owned_files`);
+                    continue;
+                }
+                const cacheKey = `dead-code-${client.id}`;
+                const prev = cacheManager.readCache(cacheKey, cwd);
+                // Back off after a timeout/kill so an unresponsive scanner cannot cost
+                // every later turn its full analysis budget (mirrors knip).
+                if (prev &&
+                    !prev.data.success &&
+                    /(timed out|killed|SIGTERM|SIGKILL|SIGABRT)/i.test(prev.data.summary)) {
+                    dbg(`turn_end: skipping dead-code after failure: ${prev.data.summary}`);
+                    deadCodeMeta.skipped = true;
+                    reasons.push(`${client.id}:backoff:${prev.data.summary}`);
+                    continue;
+                }
+                const startMs = Date.now();
+                try {
+                    const result = await client.analyze(cwd);
+                    const durationMs = Date.now() - startMs;
+                    // Never overwrite a good scan with a failure (#925, #1467): a
+                    // vulture timeout on one .py turn would otherwise evict the
+                    // session_start scan, and the backoff above would then latch
+                    // off the poisoned record.
+                    if (wouldPoisonCache(prev, result)) {
+                        dbg(`turn_end: keeping last good dead-code(${client.id}) cache; this run failed: ${result.summary}`);
+                        deadCodeMeta.cacheKept = true;
+                    }
+                    else {
+                        cacheManager.writeCache(cacheKey, result, cwd, {
+                            scanDurationMs: durationMs,
+                        });
+                    }
+                    // One event per cross-file scan (AGENTS.md) — the per-turn scan is
+                    // now the primary path, so dead-code.log must see it too.
+                    logDeadCodeScan({
+                        language: client.language,
+                        success: result.success,
+                        cached: false,
+                        unusedExports: result.unusedExports.length,
+                        unusedFiles: result.unusedFiles.length,
+                        unusedDeps: result.unusedDeps.length,
+                        unlistedDeps: result.unlistedDeps.length,
+                        durationMs: result.durationMs ?? durationMs,
+                        ...(!result.success && { reason: result.summary }),
+                    });
+                    deadCodeMeta.success = result.success;
+                    if (!result.success) {
+                        reasons.push(`${client.id}:scan_failed:${result.summary}`);
+                        continue;
+                    }
+                    deadCodeMeta.totalIssues =
+                        (deadCodeMeta.totalIssues ?? 0) + deadCodeIssues(result).length;
+                    // No baseline means every finding looks new. Report nothing rather
+                    // than blame the edit for the whole project's pre-existing debt.
+                    if (!prev?.data.success) {
+                        reasons.push(`${client.id}:no_previous_scan`);
+                        continue;
+                    }
+                    const prevKeys = new Set(deadCodeIssues(prev.data).map(deadCodeIssueKey));
+                    const modified = modifiedFiles();
+                    const newIssues = deadCodeIssues(result).filter((issue) => {
+                        if (prevKeys.has(deadCodeIssueKey(issue)))
+                            return false;
+                        if (!issue.file)
+                            return false;
+                        return modified.has(resolveRunnerPath(cwd, issue.file));
+                    });
+                    if (newIssues.length === 0) {
+                        reasons.push(`${client.id}:clean`);
+                        continue;
+                    }
+                    newIssueTotal += newIssues.length;
+                    projectDiagnosticsDelta.push(...newIssues.map((issue) => deadCodeIssueToProjectDiagnostic(cwd, issue, result.language)));
+                    projectDiagnosticsSources.add("dead-code");
+                    // @delivery-surface: runtime-turn:dead-code-advisory
+                    advisoryParts.push(formatDeadCodeDelta(newIssues, result.language));
+                }
+                catch (err) {
+                    dbg(`turn_end: dead-code(${client.id}) failed: ${err}`);
+                    reasons.push(`${client.id}:threw`);
+                }
+            }
+        }
+        catch (err) {
+            dbg(`turn_end: dead-code block failed: ${err}`);
+            reasons.push("block_threw");
+        }
+        deadCodeMeta.newIssues = newIssueTotal;
+        if (reasons.length > 0)
+            deadCodeMeta.reason = reasons.join(",");
+    }
+    logLatency({
+        type: "phase",
+        toolName: "turn_end",
+        filePath: cwd,
+        phase: "dead-code",
+        durationMs: Date.now() - tDeadCode,
+        metadata: deadCodeMeta,
+    });
+    // #1617: running total of findings this turn's advisory/blocker sections
+    // dropped because an agent/user marked them false-positive/won't-fix —
+    // the #1616 suppressed-bucket rule applied to turn_end's own reporting
+    // lanes, so a mark's effect stays visible even though the finding itself
+    // no longer appears above. Review-round F4 (#1625): kept per-lane, not
+    // just a bare total, so the eventual trace says WHICH lane's marks did
+    // the suppressing.
+    let dispositionSuppressedTotal = 0;
+    const dispositionSuppressedByLane = {};
+    function recordDispositionSuppressed(lane, count) {
+        if (count <= 0)
+            return;
+        dispositionSuppressedTotal += count;
+        dispositionSuppressedByLane[lane] =
+            (dispositionSuppressedByLane[lane] ?? 0) + count;
+    }
     // govulncheck — surface session_start-cached Go CVE findings as advisory.
     // No per-turn re-run in this slice; the cache refreshes at next session_start.
     const govCacheEntry = cacheManager.readCache("govulncheck", cwd);
-    if (govCacheEntry?.data?.findings?.length) {
-        const findings = govCacheEntry.data.findings.slice(0, 5);
+    // #1622: govulncheck renders a call site as `file:line`, and the cache is a
+    // session_start snapshot — the same stale-line shape as gitleaks, one tier
+    // lower. A CVE is pinned by go.mod, NOT by the call site, so neither an edit
+    // nor a deletion may drop it: `onMissing: "demote"` routes a vanished traced
+    // file into the same arm as an edited one. This gate only ever decides
+    // whether the cited LINE is still worth printing. (Review round H1: the first
+    // cut let a deleted trace file drop the CVE, contradicting this comment, and
+    // `citedPath` reads only the FIRST filename frame — so one deleted file in a
+    // long trace silently killed a CVE that go.mod still pins.)
+    const govGate = gateFindingsByPathFreshness({
+        store: "govulncheck",
+        findings: govCacheEntry?.data?.findings ?? [],
+        cwd,
+        scannedAt: govCacheEntry?.data?.scannedAt,
+        citedPath: (finding) => finding.trace.find((t) => t.filename)?.filename,
+        onMissing: "demote",
+    });
+    const govStale = new Set(govGate.stale);
+    // #1625 review round: the #1622 freshness gate runs FIRST — the disposition
+    // filter's anchor is derived from each finding's post-demotion identity
+    // (this array is already the gate's live+stale partition, never the raw
+    // pre-gate cache). #1627's own post-gate guard (`if (govFindings.length)`)
+    // and this round's disposition guard are the SAME guard — compose them,
+    // never fall back to a raw-cache-length check (that would print the header
+    // with zero rows beneath it whenever either filter empties the list).
+    const govFiltered = filterFindingsByDisposition([...govGate.live, ...govGate.stale], cwd, (f) => govulncheckFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("govulncheck", govFiltered.suppressed);
+    const govFindings = govFiltered.kept;
+    if (govFindings.length) {
+        const findings = govFindings.slice(0, 5);
         let report = "🛡️ Go CVEs reachable from this code (govulncheck) — upgrade where possible:\n";
         for (const f of findings) {
             const callSite = f.trace.find((t) => t.filename);
+            const stale = govStale.has(f);
             const where = callSite?.filename
-                ? `${toRunnerDisplayPath(cwd, callSite.filename)}${callSite.line ? `:${callSite.line}` : ""}`
+                ? `${toRunnerDisplayPath(cwd, callSite.filename)}${!stale && callSite.line ? `:${callSite.line}` : ""}${stale ? ` ${STALE_LINE_MARKER}` : ""}`
                 : (f.module ?? f.packageName ?? "(module)");
             const fix = f.fixedVersion
                 ? ` — upgrade to ${f.fixedVersion} or later`
                 : " — no fix yet, track upstream";
             report += `  ${f.osv} (${where})${fix}\n`;
         }
-        if (govCacheEntry.data.findings.length > findings.length) {
-            report += `  … and ${govCacheEntry.data.findings.length - findings.length} more\n`;
+        if (govFindings.length > findings.length) {
+            report += `  … and ${govFindings.length - findings.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:govulncheck-advisory
         advisoryParts.push(report);
     }
     const trivyCacheEntry = cacheManager.readCache("trivy", cwd);
@@ -495,13 +1095,93 @@ export async function handleTurnEnd(deps) {
     // location so a committed/hardcoded secret is reported ONCE (with combined
     // provenance) — a blocker, since credentials need rotation before merge.
     const gitleaksData = cacheManager.readCache("gitleaks", cwd)?.data;
+    const trivySecretsData = trivyCacheEntry?.data;
+    // #1461 slice 1 (#1460): the gitleaks cache is TTL-only, so a finding for a
+    // file deleted after the scan is still served as a 🔴 blocker for the rest
+    // of the 30-minute window — the live case, and 119 of 126 findings in
+    // pi-lens's own cache. This read is the single agent-facing consumer of that
+    // store (session_start's read only decides whether to re-scan; the
+    // project-diagnostics path re-scans fresh and reconciles at load), so the
+    // drop belongs here, before the findings enter the shared secret pipeline.
+    // #1622 extends that gate from existence to freshness, and adds trivy
+    // secrets — the sibling store with the identical shape. A cited file edited
+    // after the scan keeps its finding but loses its line number: the credential
+    // may still be there, just not where the snapshot says. Dropping instead
+    // would let any edit — malicious or accidental — mute a real secret.
+    const gitleaksGate = gateFindingsByPathFreshness({
+        store: "gitleaks",
+        findings: gitleaksData?.findings ?? [],
+        cwd,
+        scannedAt: gitleaksData?.scannedAt,
+        citedPath: (finding) => finding.file,
+    });
+    const trivySecretsGate = gateFindingsByPathFreshness({
+        store: "trivy-secrets",
+        findings: trivySecretsData?.secrets ?? [],
+        cwd,
+        scannedAt: trivySecretsData?.scannedAt,
+        citedPath: (finding) => finding.file,
+    });
+    // #1617: THE bug this issue exists for — gitleaks findings never passed
+    // through `applyDispositions`, so an agent-marked false-positive/won't-fix
+    // re-reported as a 🔴 STOP blocker on every turn. Filter through the SAME
+    // `gitleaksFindingToProjectDiagnostic` identity `lens_diagnostics
+    // mode=full` surfaces (tool="gitleaks", rule="gitleaks:<ruleId>", the
+    // exact "Potential secret: …" message) so a mark made against what the
+    // agent was shown is honored here too.
+    //
+    // #1625 review round: filtered AFTER the #1622 freshness gate above — the
+    // anchor is derived from each finding's post-demotion identity, never the
+    // raw pre-gate cache. Applied to BOTH `gitleaksGate.live` AND
+    // `gitleaksGate.stale`: `staleSecretEntries` below derives from the stale
+    // arm, and an fp-marked finding that later goes stale must not reappear
+    // there — a suppression escape (and a double count against
+    // `dispositionSuppressedTotal`) that a live-only filter would have missed.
+    //
+    // #1628: trivy-secret findings get the SAME treatment, now that
+    // `trivySecretFindingToProjectDiagnostic` (project-diagnostics/runner-
+    // adapters/trivy.ts) gives them a `lens_diagnostics`-surfaced identity
+    // (tool="trivy", rule="trivy-secret:<ruleId>") to anchor a mark against —
+    // same pattern as gitleaks above, applied to both the live and stale arms
+    // for the same reason.
+    //
+    // ast-grep secret findings need no filtering here — they already went
+    // through dispatch's applyDispositions before reaching
+    // `peekActionableWarnings()`.
+    const gitleaksLiveFiltered = filterFindingsByDisposition(gitleaksGate.live, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+    const gitleaksStaleFiltered = filterFindingsByDisposition(gitleaksGate.stale, cwd, (f) => gitleaksFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("gitleaks", gitleaksLiveFiltered.suppressed + gitleaksStaleFiltered.suppressed);
+    const trivySecretsLiveFiltered = filterFindingsByDisposition(trivySecretsGate.live, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+    const trivySecretsStaleFiltered = filterFindingsByDisposition(trivySecretsGate.stale, cwd, (f) => trivySecretFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("trivy-secrets", trivySecretsLiveFiltered.suppressed + trivySecretsStaleFiltered.suppressed);
     const astSecretWarnings = runtime
         .peekActionableWarnings()
         .filter(isSecretWarning);
     const sessionSecrets = dedupeSecretFindings([
-        ...fromGitleaks(gitleaksData?.findings ?? []),
-        ...fromTrivySecrets(trivyCacheEntry?.data?.secrets ?? []),
+        ...fromGitleaks(gitleaksLiveFiltered.kept),
+        ...fromTrivySecrets(trivySecretsLiveFiltered.kept),
     ]);
+    // Demoted secrets are addressed by FILE, never by line — the line is the one
+    // field the edit invalidated. Rule id and source survive it and must be
+    // carried through (review round M1): an agent triages an `aws-access-token`
+    // differently from a low-confidence `generic-api-key`, and cannot do that
+    // from a bare path. Deduped on file+rule+source so a file with twenty stale
+    // hits of one rule is named once.
+    const staleSecretEntries = [
+        ...gitleaksStaleFiltered.kept.map((f) => ({
+            file: toRunnerDisplayPath(cwd, f.file),
+            rule: f.ruleId,
+            source: "gitleaks",
+        })),
+        ...trivySecretsStaleFiltered.kept.map((f) => ({
+            file: toRunnerDisplayPath(cwd, f.file),
+            rule: f.ruleId,
+            source: "trivy",
+        })),
+    ];
+    const staleSecrets = [
+        ...new Map(staleSecretEntries.map((e) => [`${e.file}|${e.rule}|${e.source}`, e])).values(),
+    ];
     // Locations already surfaced as session-scan secret blockers — used to enrich
     // provenance where ast-grep agrees and to suppress the duplicate ast-grep copy
     // from the actionable-warnings advisory below.
@@ -522,14 +1202,48 @@ export async function handleTurnEnd(deps) {
         if (enriched.length > shown.length) {
             report += `  … and ${enriched.length - shown.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:secrets-gitleaks,runtime-turn:secrets-trivy
         blockerParts.push(report);
     }
+    if (staleSecrets.length) {
+        // Its OWN tier, never `advisoryParts` (review round M2). The advisory tier
+        // is labelled "no action required this turn", which would sit directly
+        // above copy telling the agent to re-scan — a section that contradicts its
+        // own heading. This preamble is imperative because the action is real: the
+        // finding is unverified, not dismissed.
+        const shown = staleSecrets.slice(0, 5);
+        let report = `🔑 ACTION NEEDED — secrets were flagged in files that changed after the scan. ${STALE_LINE_MARKER}\n` +
+            "The cached line numbers are no longer trustworthy, so they are withheld. Re-run a secrets scan to confirm or clear these:\n";
+        for (const entry of shown) {
+            report += `  ${entry.file} — ${entry.rule} [${entry.source}]\n`;
+        }
+        if (staleSecrets.length > shown.length) {
+            report += `  … and ${staleSecrets.length - shown.length} more\n`;
+        }
+        // @delivery-surface: runtime-turn:stale-secrets-tier
+        staleSecretParts.push(report);
+    }
     // trivy — surface session_start-cached dependency CVEs (#131, Phase 1).
     // CRITICAL is a blocker (a known-exploitable CVE in a shipped dep is real
     // production risk); HIGH/MEDIUM/LOW are advisory. The agent gets the upgrade
     // target as a hint and decides — we never auto-edit lockfiles.
-    if (trivyCacheEntry?.data?.findings?.length) {
-        const all = trivyCacheEntry.data.findings;
+    //
+    // #1634: these three trivy reports (critical blocker, non-critical
+    // advisory, license advisory below) name a PACKAGE, not a file:line — there
+    // is no cited path for `gateFindingsByPathFreshness` to stat, so unlike the
+    // secrets/govulncheck stores above this store cannot be freshness-GATED.
+    // It is the delivery gate's explicit-label escape hatch instead
+    // (`clients/finding-delivery-gate.ts`, surfaces `runtime-turn:trivy-*`):
+    // the session_start cache can be arbitrarily old, so its age is stated
+    // plainly rather than presenting a CRITICAL blocker as if it were current.
+    // This runs on top of (not instead of) #1625's disposition filter below —
+    // a suppressed finding never reaches this render at all, so the two only
+    // ever compose.
+    const trivyAgeLabel = formatCacheAgeLabel(trivyCacheEntry?.data?.scannedAt);
+    const trivyFindingsFiltered = filterFindingsByDisposition(trivyCacheEntry?.data?.findings ?? [], cwd, (f) => trivyFindingToProjectDiagnostic(cwd, f));
+    recordDispositionSuppressed("trivy", trivyFindingsFiltered.suppressed);
+    if (trivyFindingsFiltered.kept.length) {
+        const all = trivyFindingsFiltered.kept;
         const critical = all.filter((f) => f.severity === "CRITICAL");
         const advisory = all.filter((f) => f.severity !== "CRITICAL");
         const fmt = (f) => {
@@ -543,32 +1257,35 @@ export async function handleTurnEnd(deps) {
         };
         if (critical.length) {
             const shown = critical.slice(0, 5);
-            let report = "🔴 STOP — CRITICAL dependency CVEs (trivy). Upgrade before shipping:\n";
+            let report = `🔴 STOP — CRITICAL dependency CVEs (trivy, ${trivyAgeLabel}). Upgrade before shipping:\n`;
             for (const f of shown)
                 report += fmt(f);
             if (critical.length > shown.length) {
                 report += `  … and ${critical.length - shown.length} more\n`;
             }
+            // @delivery-surface: runtime-turn:trivy-critical-blocker
             blockerParts.push(report);
         }
         if (advisory.length) {
             const shown = advisory.slice(0, 5);
-            let report = "🛡️ Dependency CVEs (trivy) — upgrade where possible:\n";
+            let report = `🛡️ Dependency CVEs (trivy, ${trivyAgeLabel}) — upgrade where possible:\n`;
             for (const f of shown)
                 report += fmt(f);
             if (advisory.length > shown.length) {
                 report += `  … and ${advisory.length - shown.length} more\n`;
             }
+            // @delivery-surface: runtime-turn:trivy-cve-advisory
             advisoryParts.push(report);
         }
     }
     // trivy — dependency license risk (#131 Mode 4). Advisory only: a copyleft /
     // restricted license in a proprietary tree is a compliance signal, not a
-    // build break. Surfaced from the same cached `trivy fs` pass.
+    // build break. Surfaced from the same cached `trivy fs` pass — same #1634
+    // explicit-label rationale as the CVE reports above (no cited path to gate).
     const licenses = trivyCacheEntry?.data?.licenses ?? [];
     if (licenses.length) {
         const shown = licenses.slice(0, 5);
-        let report = "📜 Dependency license risk (trivy) — review for compliance:\n";
+        let report = `📜 Dependency license risk (trivy, ${trivyAgeLabel}) — review for compliance:\n`;
         for (const l of shown) {
             const cat = l.category ? `, ${l.category}` : "";
             report += `  ${l.pkgName} — ${l.license} (${l.severity}${cat})\n`;
@@ -576,11 +1293,30 @@ export async function handleTurnEnd(deps) {
         if (licenses.length > shown.length) {
             report += `  … and ${licenses.length - shown.length} more\n`;
         }
+        // @delivery-surface: runtime-turn:trivy-license-advisory
         advisoryParts.push(report);
     }
+    // #1616 suppressed-bucket rule: surface the running disposition-drop total
+    // as its own advisory line so a mark's effect is visible, not a silent
+    // absence — trace, not a vanish.
+    if (dispositionSuppressedTotal > 0) {
+        // Review-round F4 (#1625): per-lane attribution, e.g.
+        // "gitleaks 2, govulncheck 1" — not just a bare total.
+        const byLane = Object.entries(dispositionSuppressedByLane)
+            .map(([lane, count]) => `${lane} ${count}`)
+            .join(", ");
+        // @delivery-surface: runtime-turn:disposition-suppressed-notice
+        advisoryParts.push(`suppressed by disposition: ${dispositionSuppressedTotal} finding(s) ` +
+            `dropped from this turn's gitleaks/govulncheck/trivy sections (${byLane}) ` +
+            "(marked false-positive or won't-fix).");
+    }
     const t3 = Date.now();
     let madgeStats;
-    if (await depChecker.ensureAvailable()) {
+    // Off by default (#766): this pass only writes debug output, and user-facing
+    // madge diagnostics come from the session-start `madge` cache + the
+    // `lens_diagnostics` extractor. Enabled with `--lens-turn-end-madge` /
+    // `turnEnd.madge.enabled=true` for those who want the per-edit circular note.
+    if (getFlag("lens-turn-end-madge") && (await depChecker.ensureAvailable())) {
         const madgeFiles = cacheManager.getFilesForMadge(cwd);
         if (madgeFiles.length > 0) {
             dbg(`turn_end: madge checking ${madgeFiles.length} file(s) for circular deps`);
@@ -616,7 +1352,9 @@ export async function handleTurnEnd(deps) {
         filePath: cwd,
         phase: "madge",
         durationMs: Date.now() - t3,
-        ...(madgeStats && { metadata: madgeStats }),
+        // A ~0ms entry with no metadata is indistinguishable from "ran and was
+        // fast" when re-analyzing the #766 tail — mark the skipped case.
+        metadata: madgeStats ?? { skipped: true },
     });
     // --- Test runner: fire once per turn after all edits are done ---
     // Runs for each unique test target across modified files; results appear
@@ -668,8 +1406,38 @@ export async function handleTurnEnd(deps) {
             dbg(`turn_end: firing ${targets.length} test target(s) async (non-blocking)`);
             const firedAtTurn = runtime.turnIndex;
             const firedSessionId = runtime.telemetrySessionId;
+            const priorTestCache = cacheManager.readCache("test-runner-findings", cwd)?.data;
+            const testRunGeneration = (priorTestCache?.testRunGeneration ?? 0) + 1;
+            const provenanceFiles = [
+                ...candidates.map((candidate) => ({
+                    path: candidate.abs,
+                    role: "source",
+                })),
+                ...targets.map((target) => ({
+                    path: target.testFile,
+                    role: "test",
+                })),
+            ];
+            const launchedFrom = snapshotAdvisoryProvenance({
+                cwd,
+                runtime,
+                generation: testRunGeneration,
+                files: provenanceFiles,
+            });
+            cacheManager.writeCache("test-runner-findings", { ...(priorTestCache ?? { content: "" }), testRunGeneration }, cwd);
             Promise.allSettled(targets.map((t) => testRunnerClient.runTestFileAsync(t.testFile, cwd, t.runner, t.config)))
                 .then((results) => {
+                const publishedAgainst = snapshotAdvisoryProvenance({
+                    cwd,
+                    runtime,
+                    generation: testRunGeneration,
+                    files: provenanceFiles,
+                });
+                const superseded = launchedFrom.revision.sessionId !== publishedAgainst.revision.sessionId ||
+                    launchedFrom.revision.projectSeq !== publishedAgainst.revision.projectSeq ||
+                    launchedFrom.revision.turnIndex !== publishedAgainst.revision.turnIndex ||
+                    launchedFrom.files.some((file, index) => publishedAgainst.files[index]?.sha256 !== file.sha256 ||
+                        publishedAgainst.files[index]?.path !== file.path);
                 // #628: the turn advancing while tests ran no longer means the
                 // results are thrown away — a late result is still real
                 // information about what's currently broken. It's tagged `stale`
@@ -686,25 +1454,85 @@ export async function handleTurnEnd(deps) {
                     resultValues.push(r.value);
                     const { file, runner, passed, failed, duration, error } = r.value;
                     const shortFile = path.basename(file);
+                    // #1479: `(0ms)` used to be printed for a run nobody
+                    // timed — a payload with no suite timestamps, an
+                    // unrecognised summary line, or an empty result — and
+                    // that is the same string a genuinely sub-millisecond
+                    // run produces. A reader could not tell "measured 0"
+                    // from "not measured", which is the confusion #1452 was
+                    // reported for. `duration` is now absent when it was
+                    // never measured, and this line says which one it has.
+                    //
+                    // #1480: the test is `formatRunDurationMs`, not an
+                    // inline comparison. The "absent = unmeasured" contract
+                    // was being re-derived at every site that read a
+                    // duration, and a site that gets it slightly wrong —
+                    // treating a measured `0` as absent — puts the bug back
+                    // without touching this comment.
+                    const elapsed = formatRunDurationMs(duration);
+                    // Lifted out of the template below for the same reason
+                    // `elapsed` is: the pair read as a nested ternary, which
+                    // this line only got flagged for because #1479 touched it.
+                    const verdict = failed > 0 ? "FAIL" : "PASS";
                     const summary = error && passed === 0 && failed === 0
                         ? `error: ${error}`
-                        : `${failed > 0 ? "FAIL" : "PASS"} ${passed}p/${failed}f (${duration}ms)`;
+                        : `${verdict} ${passed}p/${failed}f (${elapsed})`;
                     dbg(`turn_end: ${stale ? "[stale] " : ""}test ${runner} ${shortFile} → ${summary}`);
-                    if (failed > 0) {
+                    // #1524: also fires on `error` alone, not just `failed > 0`.
+                    // A runner-error result (the suite never started — spawn/
+                    // config failure) has `failed === 0` by construction, so
+                    // gating on `failed > 0` alone dropped it silently: the
+                    // agent got no context at all, and the empty `failures`
+                    // array below sent this result down the "all tests
+                    // passed" branch, clearing any prior real test-failure
+                    // git-guard blocker. `formatResult` already renders the
+                    // error-only case as "Could not run tests: ...".
+                    if (failed > 0 || error) {
                         const formatted = testRunnerClient.formatResult(r.value);
                         if (formatted)
                             failures.push(formatted);
                     }
                 }
                 if (failures.length > 0) {
+                    const currentGeneration = cacheManager.readCache("test-runner-findings", cwd)?.data?.testRunGeneration;
+                    if (currentGeneration !== undefined &&
+                        currentGeneration > testRunGeneration) {
+                        dbg(`turn_end: test generation ${testRunGeneration} superseded by ${currentGeneration}`);
+                        return;
+                    }
                     const content = stale
                         ? `[from a prior turn — the edit that triggered this run had already been superseded by the time results came back]\n\n${failures.join("\n\n")}`
                         : failures.join("\n\n");
-                    cacheManager.writeCache("test-runner-findings", { content, stale, results: resultValues }, cwd);
+                    cacheManager.writeCache("test-runner-findings", {
+                        content,
+                        stale,
+                        results: resultValues,
+                        testRunGeneration,
+                        launchedFrom,
+                        publishedAgainst,
+                        provenance: publishedAgainst,
+                        superseded,
+                    }, cwd);
                     if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
-                        clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues
-                            .filter((value) => value.failed === 0)
-                            .map((value) => value.file));
+                        // #1524: `&& !value.error` — a runner-error result has
+                        // `failed === 0` (the suite never ran, so nothing could
+                        // fail), but it is not a pass. Without the filter it
+                        // would clear a prior real test-failure git-guard
+                        // blocker on the strength of a suite that never
+                        // started. And the call itself is skipped when this
+                        // list is empty rather than passed as `[]`:
+                        // `clearGitGuardTestFailure`'s own empty-array
+                        // fallback treats "no files named" as "clear every
+                        // blocked file", so an all-error batch (one go file,
+                        // runner-error, zero clean files) would otherwise
+                        // clear every blocker through that fallback instead
+                        // of clearing none.
+                        const cleanFiles = resultValues
+                            .filter((value) => value.failed === 0 && !value.error)
+                            .map((value) => value.file);
+                        if (cleanFiles.length > 0) {
+                            clearGitGuardTestFailure(cacheManager, cwd, runtime, cleanFiles);
+                        }
                         mergeGitGuardTestFailure(cacheManager, cwd, runtime, content, resultValues
                             .filter((value) => value.failed > 0)
                             .map((value) => value.file));
@@ -712,7 +1540,8 @@ export async function handleTurnEnd(deps) {
                     dbg(`turn_end: ${failures.length} test failure(s) cached for next context injection${stale ? " (stale — turn advanced while tests ran)" : ""}`);
                 }
                 else if (results.length > 0) {
-                    if (getFlag("lens-guard") && firedSessionId === runtime.telemetrySessionId) {
+                    if (getFlag("lens-guard") &&
+                        firedSessionId === runtime.telemetrySessionId) {
                         clearGitGuardTestFailure(cacheManager, cwd, runtime, resultValues.map((value) => value.file));
                     }
                     dbg(`turn_end: all tests passed${stale ? " (stale — turn advanced while tests ran)" : ""}`);
@@ -745,6 +1574,7 @@ export async function handleTurnEnd(deps) {
             // into an authoritative-looking clean result for the rest of the file.
             // Keep the limitation visible and require a complete graph for this
             // user-facing impact surface (#1070).
+            // @delivery-surface: runtime-turn:call-graph-advisory
             advisoryParts.push("Call-graph impact was not emitted because call-graph extraction coverage is incomplete; " +
                 "the affected files may have unreported callers.");
         }
@@ -762,7 +1592,8 @@ export async function handleTurnEnd(deps) {
                     const changedFileKey = normalizeMapKey(resolveRunnerPath(cwd, filePath));
                     const fileCallerKeys = [...runtime.callGraph.callers.keys()].filter((k) => {
                         const graphFilePath = parseSymbolKey(k).filePath;
-                        return normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) === changedFileKey;
+                        return (normalizeMapKey(resolveRunnerPath(cwd, graphFilePath)) ===
+                            changedFileKey);
                     });
                     for (const calleeKey of fileCallerKeys.slice(0, 3)) {
                         // #1080: drop KNOWN test-role callers BEFORE both the human advisory
@@ -786,6 +1617,7 @@ export async function handleTurnEnd(deps) {
                     }
                 }
                 if (impactLines.length > 0) {
+                    // @delivery-surface: runtime-turn:call-graph-advisory
                     advisoryParts.push(`📊 Call-graph impact (changed symbols have callers):\n${impactLines.join("\n")}`);
                 }
                 if (impactFindings.length > 0) {
@@ -854,6 +1686,7 @@ export async function handleTurnEnd(deps) {
             writeActionableWarningsReport(cacheManager, cwd, report);
             appendActionableWarningsHistory(cwd, report);
             const advisory = formatActionableWarningsAdvisory(report);
+            // @delivery-surface: runtime-turn:actionable-warnings-advisory
             if (advisory)
                 advisoryParts.push(advisory);
             logActionableWarningsEvent({
@@ -903,6 +1736,7 @@ export async function handleTurnEnd(deps) {
         writeCodeQualityWarningsReport(cacheManager, cwd, qualityReport);
         appendCodeQualityWarningsHistory(cwd, qualityReport);
         const advisory = formatCodeQualityWarningsAdvisory(qualityReport);
+        // @delivery-surface: runtime-turn:code-quality-warnings-advisory
         if (advisory)
             advisoryParts.push(advisory);
         logLatency({
@@ -928,29 +1762,15 @@ export async function handleTurnEnd(deps) {
             },
         });
     }
-    // Cross-file dead-code (#127): surface the cached session_start scan as an
-    // advisory (project-wide unused symbols are slow to compute, so we read the
-    // cache rather than re-scanning every turn — the analogue of knip's cache
-    // for non-JS/TS languages). Merged across languages for polyglot repos.
-    try {
-        const deadCodeResults = [];
-        for (const client of deadCodeClients) {
-            if (!client.detect(cwd))
-                continue;
-            const cached = cacheManager.readCache(`dead-code-${client.id}`, cwd);
-            if (cached?.data)
-                deadCodeResults.push(cached.data);
-        }
-        const advisory = formatDeadCodeAdvisory(deadCodeResults);
-        if (advisory)
-            advisoryParts.push(advisory);
-    }
-    catch (err) {
-        dbg(`turn_end: dead-code advisory failed: ${err}`);
-    }
     cacheManager.incrementTurnCycle(cwd, currentOwner);
     const labeledAdvisoryParts = advisoryParts.map((p) => `ℹ️ Advisory — no action required this turn:\n${p}`);
-    const findingParts = [...blockerParts, ...labeledAdvisoryParts];
+    // Stale-secret parts sit between the two tiers and are NOT relabelled — they
+    // ship the imperative preamble they were built with (#1622 review M2).
+    const findingParts = [
+        ...blockerParts,
+        ...staleSecretParts,
+        ...labeledAdvisoryParts,
+    ];
     if (findingParts.length > 0) {
         dbg(`turn_end: ${blockerParts.length} blocker section(s), ${advisoryParts.length} advisory section(s) found, persisting for next context`);
         const content = capTurnEndMessage(findingParts.join("\n\n"));
@@ -975,7 +1795,12 @@ export async function handleTurnEnd(deps) {
                         blockingFiles: blockerParts.length > 0 ? existingGuard.affectedFiles : undefined,
                         projectSeqStart: runtime.turnStartProjectSeq,
                         projectSeqEnd: runtime.projectSeq,
-                        fileSeqByPath: Object.fromEntries(runtime.getFileSeqEntries().map(([filePath, seq]) => [normalizeMapKey(path.resolve(filePath)), seq])),
+                        fileSeqByPath: Object.fromEntries(runtime
+                            .getFileSeqEntries()
+                            .map(([filePath, seq]) => [
+                            normalizeMapKey(path.resolve(filePath)),
+                            seq,
+                        ])),
                         fileContentHashes: {},
                         consumed: false,
                     });
@@ -1022,7 +1847,29 @@ export async function handleTurnEnd(deps) {
             });
         }
         else {
-            cacheManager.writeCache("turn-end-findings", { content }, cwd);
+            const allAffectedFiles = [
+                ...files.map((file) => resolveRunnerPath(cwd, file)),
+                ...cascadeResults.flatMap((result) => result.neighbors
+                    .filter((neighbor) => neighbor.diagnostics.length > 0)
+                    .map((neighbor) => resolveRunnerPath(cwd, neighbor.filePath))),
+            ];
+            const affectedFiles = [...new Set(allAffectedFiles)].slice(0, MAX_ADVISORY_AFFECTED_FILES);
+            const affectedFilesTruncated = new Set(allAffectedFiles).size > affectedFiles.length;
+            cacheManager.writeCache("turn-end-findings", {
+                content,
+                affectedFiles,
+                affectedFilesTruncated,
+                provenance: snapshotAdvisoryProvenance({
+                    cwd,
+                    runtime,
+                    generation: 0,
+                    files: affectedFiles.map((file) => ({
+                        path: file,
+                        role: "affected",
+                    })),
+                    truncated: affectedFilesTruncated,
+                }),
+            }, cwd);
         }
         cacheManager.writeCache("turn-end-findings-last", {
             signature,
@@ -1042,7 +1889,13 @@ export async function handleTurnEnd(deps) {
     }
     if (blockerParts.length === 0) {
         cacheManager.clearTurnState(cwd, currentOwner);
-        if (getFlag("lens-guard") && advisoryParts.length === 0 && !runtime.gitGuardHasBlockers) {
+        // `staleSecretParts` counts here too (#1622 review M2): clearing the
+        // findings record while a stale secret is still unverified would drop the
+        // only surviving trace of it.
+        if (getFlag("lens-guard") &&
+            advisoryParts.length === 0 &&
+            staleSecretParts.length === 0 &&
+            !runtime.gitGuardHasBlockers) {
             const guardRecord = cacheManager.readCache("turn-end-findings", cwd)?.data;
             if (guardRecord?.sessionId === runtime.telemetrySessionId &&
                 guardRecord.testFailures !== true) {
@@ -1058,10 +1911,18 @@ export async function handleTurnEnd(deps) {
         toolName: "turn_end",
         filePath: cwd,
         durationMs: Date.now() - turnEndStart,
-        result: blockerParts.length > 0 ? "blockers_found" : "clean",
+        // #1622 review M2: a pending stale secret is NOT a clean turn. It gets its
+        // own result rather than being promoted to `blockers_found`, which would
+        // undo the demotion the freshness gate just made.
+        result: blockerParts.length > 0
+            ? "blockers_found"
+            : staleSecretParts.length > 0
+                ? "stale_secrets_pending"
+                : "clean",
         metadata: {
             fileCount: files.length,
             blockerSections: blockerParts.length,
+            staleSecretSections: staleSecretParts.length,
             advisorySections: advisoryParts.length,
         },
     });