@herbertgao/pi-extensions 2026.8.6 → 2026.8.7

package/node_modules/pi-lens/dist/clients/biome-client.js

@@ -14,9 +14,10 @@ import { isFileKind } from "./file-kinds.js";
 import { getGlobalPiLensDir } from "./file-utils.js";
 import { findGlobalBinary } from "./package-manager.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { createSingleFlight } from "./single-flight.js";
 import { biomeConfigArgs } from "./tool-policy.js";
 import { resolveManagedToolClient, } from "./dispatch/runners/utils/runner-helpers.js";
-import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
+import { classifyProbeFailure, describeInstallAttempt, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 // --- Client ---
 const PROBE_TIMEOUT_MS = 10_000;
 export class BiomeClient {
@@ -39,6 +40,8 @@ export class BiomeClient {
      */
     lastProbeElapsedMs = 0;
     lastProbeHostStallMs = 0;
+    /** Raw facts from the last probe, carried into the decision record (#1500). */
+    lastProbeEvidence;
     // Per-cwd cache of the resolved biome binary. Keying by cwd matters in
     // monorepos where different sub-packages each ship their own biome
     // installation; sharing one slot across the whole client would cause
@@ -48,7 +51,11 @@ export class BiomeClient {
     // (lives under ~/.pi-lens/tools), so it's stored separately from the
     // per-cwd cache and used as a final fallback before npx.
     autoInstalledBinaryPath = null;
-    ensureInFlight = null;
+    /**
+     * At-most-one probe/auto-install in flight, via the shared primitive
+     * (#1753). One instance owns one question, so the key is a constant.
+     */
+    ensureFlight = createSingleFlight();
     log;
     constructor(verbose = false) {
         this.log = verbose
@@ -70,13 +77,14 @@ export class BiomeClient {
         const cached = this.localBinaryByCwd.get(resolveCwd);
         if (cached)
             return { cmd: cached, args: [] };
-        if (this.autoInstalledBinaryPath) {
-            return { cmd: this.autoInstalledBinaryPath, args: [] };
-        }
-        // Walk up from cwd looking for node_modules/.bin/biome.
-        // Also check ~/.pi-lens/tools (where ensureTool("biome") auto-installs),
-        // so we avoid the ~1.5s `npx @biomejs/biome --version` fallback when
-        // the tool is already installed but not in the project's node_modules.
+        // Walk up from cwd looking for node_modules/.bin/biome BEFORE trusting
+        // `autoInstalledBinaryPath` (#1731). That field is set once, the first
+        // time `ensureAvailable()` auto-installs for ANY cwd this session, and
+        // every later call for every OTHER cwd short-circuited on it — so a
+        // project that ships its own biome never won once the session's first
+        // managed install had already happened. Project-local-first (discipline
+        // B, #1721) means the project's pinned version and config resolution
+        // always outrank a managed copy, autoinstalled or not.
         // On Windows prefer .cmd (native batch) over the sh wrapper — 2x faster.
         const isWin = process.platform === "win32";
         const piLensBin = path.join(getGlobalPiLensDir(), "tools", "node_modules", ".bin");
@@ -84,20 +92,29 @@ export class BiomeClient {
             ? [
                 path.join(resolveCwd, "node_modules", ".bin", "biome.cmd"),
                 path.join(resolveCwd, "node_modules", ".bin", "biome"),
-                path.join(piLensBin, "biome.cmd"),
-                path.join(piLensBin, "biome"),
             ]
-            : [
-                path.join(resolveCwd, "node_modules", ".bin", "biome"),
-                path.join(resolveCwd, "node_modules", ".bin", "biome.cmd"),
-                path.join(piLensBin, "biome"),
-            ];
+            : [path.join(resolveCwd, "node_modules", ".bin", "biome")];
         for (const p of candidates) {
             if (fs.existsSync(p)) {
                 this.localBinaryByCwd.set(resolveCwd, p);
                 return { cmd: p, args: [] };
             }
         }
+        if (this.autoInstalledBinaryPath) {
+            return { cmd: this.autoInstalledBinaryPath, args: [] };
+        }
+        // Also check ~/.pi-lens/tools (where ensureTool("biome") auto-installs),
+        // so we avoid the ~1.5s `npx @biomejs/biome --version` fallback when the
+        // tool is already installed but not in the project's node_modules.
+        const managedCandidates = isWin
+            ? [path.join(piLensBin, "biome.cmd"), path.join(piLensBin, "biome")]
+            : [path.join(piLensBin, "biome")];
+        for (const p of managedCandidates) {
+            if (fs.existsSync(p)) {
+                this.localBinaryByCwd.set(resolveCwd, p);
+                return { cmd: p, args: [] };
+            }
+        }
         // Any package manager's global bin dir (npm/pnpm/yarn/bun) before npx —
         // catches `pnpm add -g @biomejs/biome` installs that PATH misses (#375).
         const global = await findGlobalBinary("biome");
@@ -116,10 +133,11 @@ export class BiomeClient {
      * Ensure Biome is available, auto-installing if necessary.
      * Prefer this over isAvailable() for auto-install behavior.
      *
-     * Re-entrancy safe: concurrent first-time callers share a single
-     * `ensureInFlight` promise so probing/auto-install isn't duplicated.
-     * Mirrors the dedupe pattern in `SgRunner` / `KnipClient` /
-     * `DependencyChecker`.
+     * Re-entrancy safe: concurrent first-time callers share one flight, so
+     * probing/auto-install isn't duplicated. The share and the clear-in-finally
+     * belong to `singleFlight` (#1753); this method owns only the latch
+     * short-circuit above it. #1690 exists because the hand-rolled clear here
+     * was never exercised by a test.
      *
      * The memo returns `null` when the last verdict was transient and its
      * cooldown expired, which re-enters the probe: "biome is not installed" is a
@@ -129,15 +147,7 @@ export class BiomeClient {
         const memo = this.availabilityLatch.read();
         if (memo !== null)
             return memo;
-        if (this.ensureInFlight)
-            return this.ensureInFlight;
-        this.ensureInFlight = this.doEnsureAvailable();
-        try {
-            return await this.ensureInFlight;
-        }
-        finally {
-            this.ensureInFlight = null;
-        }
+        return this.ensureFlight.run("biome", () => this.doEnsureAvailable());
     }
     /**
      * Probe `biome --version` and classify the failure through the shared
@@ -177,7 +187,7 @@ export class BiomeClient {
         // `unclassifiedFailureOutcome: "missing"` preserves the pre-#1476
         // meaning of a plain non-zero exit (npx reporting no biome package):
         // still "missing", still installable. Only the timeout/abort arm changes.
-        const { outcome, cause } = classifyProbeFailure(result, {
+        const { outcome, cause, evidence } = classifyProbeFailure(result, {
             hostStallMs,
             unclassifiedFailureOutcome: "missing",
         });
@@ -187,6 +197,7 @@ export class BiomeClient {
         this.lastProbeCause = cause;
         this.lastProbeElapsedMs = elapsedMs;
         this.lastProbeHostStallMs = hostStallMs;
+        this.lastProbeEvidence = evidence;
         // The record is emitted by `doEnsureAvailable`, once the latch has said how
         // long this verdict holds.
         return { outcome: failureOutcome };
@@ -224,6 +235,19 @@ export class BiomeClient {
         // session exactly as before.
         const cause = this.lastProbeCause ?? "not-found";
         const retryAfterMs = this.availabilityLatch.noteUnavailable(resolved.outcome, cause);
+        // `missing` IS the install-failure arm (#1500 review). `resolveManagedToolClient`
+        // only reaches the installer when the probe said `missing`, so every `missing`
+        // verdict here has already been through it — declined, suppressed, or tried
+        // and failed, which is what `describeInstallAttempt` separates. The earlier
+        // marker sat on the `non-installable` arm instead, and that arm cannot happen
+        // for biome at all: its `acceptInstalled` always accepts. So the one row that
+        // needed the fact was the one shipping without it.
+        let installEvidence;
+        if (resolved.outcome === "missing") {
+            const { getInstallAttempt } = await import("./installer/index.js");
+            installEvidence = describeInstallAttempt(getInstallAttempt("biome"));
+        }
+        const evidence = { ...this.lastProbeEvidence, ...installEvidence };
         logAvailabilityDecision({
             tool: "biome",
             verdict: "unavailable",
@@ -234,6 +258,13 @@ export class BiomeClient {
             hostStallMs: this.lastProbeHostStallMs,
             ...(retryAfterMs > 0 && { retryAfterMs }),
             budgetMs: PROBE_TIMEOUT_MS,
+            // Per arm: a probe-derived verdict says `probe`, while a verdict asserted
+            // by the install seam — or a cause that fell back because no probe ran —
+            // says `caller`.
+            classifiedBy: this.lastProbeCause === null || resolved.outcome === "non-installable"
+                ? "caller"
+                : "probe",
+            ...(Object.keys(evidence).length > 0 && { evidence }),
         });
         if (resolved.outcome === "transient") {
             this.log("biome availability probe timed out; will retry (not installing)");

package/node_modules/pi-lens/dist/clients/blocker-freshness.js

@@ -0,0 +1,428 @@
+/**
+ * Turn-boundary freshness gate for cached inline blockers (#1631).
+ *
+ * An inline blocker recorded for a file F is a verdict about F *and everything F
+ * imports*. The existing invalidation paths all key on F alone — a later dispatch
+ * of the SAME path returning no blockers, the path ceasing to exist (#1245), and a
+ * fresh confirmed-clean verdict (#1561/#1573). When only a DEPENDENCY of F changes,
+ * none of those events fire, so F's stale verdict re-served at every turn end for
+ * the rest of the session. The live instances in #1631 are exactly that shape: the
+ * missing export was added to the dependency (one via a bash script, so the
+ * dependency was never dispatched at all — even the same-path event was unreachable
+ * by construction).
+ *
+ * The gate here is a READ-time freshness sweep, not the #1561 dependency-axis
+ * invalidation (which stays blocked on a maintainer design decision). Before a cached
+ * blocking finding is re-served at turn end, stat the file and its forward imports.
+ * The file's own import list comes from the parse layer — no reverse-dependency index
+ * is needed, sidestepping the tests-free-index blocker that holds #1561's remainder.
+ *
+ * Drifted entries are DEMOTED, not dropped (#1419 precedent, as applied by sibling
+ * issue #1622): a surviving file whose content drifted gets re-served with a
+ * `[stale — re-run to confirm]` marker and out of the authoritative blocker channel,
+ * rather than being silently deleted or re-asserted at full authority. The gate never
+ * re-pulls LSP verdicts on its own — a drifted entry is marked stale and left for an
+ * explicit re-run or the next dispatch to resolve. That keeps the sweep bounded and
+ * free of the document-resync hazard the issue calls out (re-querying an LSP whose
+ * in-memory dependency document is itself stale would regenerate the stale verdict).
+ *
+ * Scope (#1631 review F4): an inline blocker is not always LSP-only —
+ * `dispatcher.ts` builds it from every `semantic === "blocking"` diagnostic across
+ * all runners, so an eslint, biome-check, or ast-grep security-rule (hardcoded
+ * secret, CVE) finding can land here too. Only a language-server verdict is
+ * actually invalidated by an IMPORT changing; an ast-grep secret match doesn't stop
+ * being true because a file it imports was edited. The sweep therefore demotes an
+ * entry only when its recorded `sources` (`InlineBlockerRecord.sources`) are ALL
+ * `"lsp"` — a mixed or non-LSP-sourced blocker is left fully authoritative, the same
+ * fail-closed shape `retireInlineBlockerOnConfirmedClean` already uses for
+ * provenance it can't yet reason about.
+ *
+ * Resolution boundary (#1631 review F8): `extractForwardImportPaths` parses static
+ * import/require syntax via tree-sitter. It does not, and cannot, resolve a
+ * dependency reached only through a dynamic `import()` or `require()` behind a
+ * runtime condition — that edge is invisible to this gate, so a blocker whose only
+ * stale dependency arrives that way survives a replay. This is an honest boundary,
+ * not a silently-closed one.
+ */
+import * as fs from "node:fs";
+import { normalizeEphemeralMapKey } from "./path-utils.js";
+import { resolveImportToFiles } from "./review-graph/import-resolvers.js";
+import { getSharedTreeSitterClient, resolveTreeSitterLanguage, } from "./tree-sitter-shared.js";
+import { TreeSitterSymbolExtractor } from "./tree-sitter-symbol-extractor.js";
+/**
+ * Upper bound on the number of forward imports stat-checked for a single blocker.
+ * Blocking entries are rare, but one file can import many modules; the sweep must
+ * stay bounded so it cannot inflate a turn end.
+ */
+const MAX_DRIFT_CHECK_IMPORTS = 128;
+// Per-language extractor cache, mirroring review-graph/builder.ts and
+// module-report.ts. Memoize failures too: a grammar that fails to load once is not
+// re-probed for every blocker of that language within the process.
+const extractorCache = new Map();
+function getExtractor(languageId) {
+    let cached = extractorCache.get(languageId);
+    if (!cached) {
+        cached = (async () => {
+            const client = getSharedTreeSitterClient();
+            if (!client)
+                return null;
+            const extractor = new TreeSitterSymbolExtractor(languageId, client);
+            const ok = await extractor.init();
+            return ok ? extractor : null;
+        })().catch(() => null);
+        extractorCache.set(languageId, cached);
+    }
+    return cached;
+}
+/**
+ * #1631 review F6: memoized forward-import RESOLUTION (the parse step, not the
+ * per-dependency mtime stats — those must always be read fresh so drift is never
+ * missed). Reviewer measurement: ~450ms/turn at 8 blockers × 300 imports
+ * unmemoized, ~435ms per `mode=all` call, because both the turn-end sweep and the
+ * `mode=all` gate independently re-parse the SAME consumer files' import lists.
+ *
+ * Keyed on (path, own mtime) — a cache hit is safe by construction: if the file's
+ * mtime hasn't moved, its parsed import LIST cannot have changed (the imports
+ * themselves may still have drifted; that's what the mtime stats after this cache
+ * check are for). Scoped PER TURN, not process-lifetime (the latch screen this
+ * class of state must pass): `noteImportResolutionMemoTurn` clears it whenever the
+ * `RuntimeCoordinator`'s `turnIndex` advances, so a resolver injected for one test
+ * or a project whose import graph is edited mid-session is never served a result
+ * from a stale earlier turn. When no turn index is available (mode=all called
+ * outside a tracked turn, or a test with no runtime), the cache is left alone —
+ * still correct because of the mtime key, just not turn-bounded in that case.
+ */
+const importResolutionMemo = new Map();
+let importResolutionMemoTurnIndex;
+function noteImportResolutionMemoTurn(turnIndex) {
+    if (turnIndex === undefined)
+        return;
+    if (importResolutionMemoTurnIndex !== turnIndex) {
+        importResolutionMemo.clear();
+        importResolutionMemoTurnIndex = turnIndex;
+    }
+}
+async function resolveForwardImportsMemoized(cwd, filePath, resolveForwardImports) {
+    const sig = await statSignature(filePath);
+    if (sig === undefined) {
+        // Can't key reliably (deleted/unreadable) — resolve uncached rather than
+        // risk serving a memo entry for content that may no longer exist.
+        try {
+            return await resolveForwardImports(cwd, filePath);
+        }
+        catch {
+            return [];
+        }
+    }
+    const cached = importResolutionMemo.get(filePath);
+    // mtime alone collides for writes within the same timestamp tick (~1ms);
+    // size disambiguates the shrink-then-restore case (#1641's measurement).
+    if (cached && cached.mtimeMs === sig.mtimeMs && cached.size === sig.size)
+        return cached.imports;
+    let imports;
+    try {
+        imports = await resolveForwardImports(cwd, filePath);
+    }
+    catch {
+        imports = [];
+    }
+    importResolutionMemo.set(filePath, { mtimeMs: sig.mtimeMs, size: sig.size, imports });
+    return imports;
+}
+/** Test-only: clear the extractor and import-resolution memos. */
+export function _resetBlockerFreshnessForTests() {
+    extractorCache.clear();
+    importResolutionMemo.clear();
+    importResolutionMemoTurnIndex = undefined;
+}
+/**
+ * Production forward-import resolver. Parses `filePath` with its tree-sitter grammar
+ * and resolves every extracted import source to in-project files. Degrades to an
+ * empty list (never throws) when the grammar, client, or file is unavailable — the
+ * sweep then falls back to checking only the blocker file's own drift.
+ */
+export async function extractForwardImportPaths(cwd, filePath) {
+    const languageId = resolveTreeSitterLanguage(filePath);
+    if (!languageId)
+        return [];
+    const client = getSharedTreeSitterClient();
+    if (!client)
+        return [];
+    const extractor = await getExtractor(languageId);
+    if (!extractor)
+        return [];
+    let content;
+    try {
+        content = fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const outcome = await client.withParsedTree(filePath, languageId, content, (tree) => extractor.extract(tree, filePath, content).imports);
+    if (!outcome.parsed)
+        return [];
+    const resolved = new Set();
+    for (const ref of outcome.value) {
+        for (const target of resolveImportToFiles(cwd, filePath, languageId, ref.source)) {
+            resolved.add(target);
+        }
+    }
+    return [...resolved];
+}
+async function statSignature(filePath) {
+    try {
+        const stat = await fs.promises.stat(filePath);
+        return { mtimeMs: stat.mtimeMs, size: stat.size };
+    }
+    catch {
+        return undefined;
+    }
+}
+async function statMtimeMs(filePath) {
+    try {
+        const stat = await fs.promises.stat(filePath);
+        return stat.mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve `filePath`'s forward imports and stat each, returning the imports that
+ * exist together with their mtime. Shared by the inline-blocker sweep and the
+ * widget-store dependency reconcile so both gates weigh drift identically. A path
+ * that cannot be stat'ed (deleted/unreadable) is omitted — a deleted dependency is
+ * not a content drift this gate reports.
+ */
+export async function collectForwardImportMtimes(cwd, filePath, resolveForwardImports = extractForwardImportPaths, turnIndex) {
+    noteImportResolutionMemoTurn(turnIndex);
+    let imports = [];
+    try {
+        imports = await resolveForwardImportsMemoized(cwd, filePath, resolveForwardImports);
+    }
+    catch {
+        imports = [];
+    }
+    const truncated = imports.length > MAX_DRIFT_CHECK_IMPORTS;
+    const out = [];
+    for (const dep of imports.slice(0, MAX_DRIFT_CHECK_IMPORTS)) {
+        const mtimeMs = await statMtimeMs(dep);
+        if (mtimeMs !== undefined)
+            out.push({ path: dep, mtimeMs });
+    }
+    return { mtimes: out, truncated };
+}
+/**
+ * Detect drift for one blocker entry. Returns the set of paths (the file itself plus
+ * any forward import) whose mtime is strictly newer than the verdict baseline. A
+ * missing/unstat-able path contributes nothing here — a DELETED blocker file is
+ * already dropped by `reconcileInlineBlockers`, and a deleted dependency is not a
+ * content drift this gate is responsible for.
+ *
+ * +50ms tolerance. The verdict baseline is `Date.now()`, but on Windows a file's
+ * mtime can LEAD `Date.now()` by a measurable margin — not just sub-millisecond
+ * rounding. Reviewer measurement across 200 writes on Windows: 184/200 mtimes read
+ * ahead of the immediately-following `Date.now()`, by up to ~11.4ms, the same host
+ * skew #1491/#1498 hit for install-probe timestamps. A +1ms tolerance (the
+ * convention borrowed from `reconcileStaleWidgetFiles` /
+ * `reconcileProjectDiagnosticsSnapshot`, both same-process single-writer paths
+ * without this skew) demoted a blocker recorded immediately after its own file
+ * write with zero real drift — 42 false demotions in 50 runs, and two of this
+ * gate's own tests went host-dependent (red 3/6 runs on Windows, green 6/6 at
+ * +50ms). +50ms comfortably clears the measured skew while staying far below the
+ * gap between genuinely distinct edits.
+ */
+export const MTIME_DRIFT_TOLERANCE_MS = 50;
+async function detectDrift(cwd, filePath, recordedAtMs, resolveForwardImports, turnIndex) {
+    const drifted = [];
+    const ownMtimeMs = await statMtimeMs(filePath);
+    if (ownMtimeMs !== undefined && ownMtimeMs > recordedAtMs + MTIME_DRIFT_TOLERANCE_MS) {
+        drifted.push(filePath);
+    }
+    const { mtimes, truncated } = await collectForwardImportMtimes(cwd, filePath, resolveForwardImports, turnIndex);
+    for (const { path, mtimeMs } of mtimes) {
+        if (mtimeMs > recordedAtMs + MTIME_DRIFT_TOLERANCE_MS)
+            drifted.push(path);
+    }
+    return { drifted, truncated };
+}
+/**
+ * Whether a population entry is eligible for the drift check at all — the same
+ * three gates the main sweep loop applies (not already stale, has a timestamp
+ * baseline, all-`"lsp"` sources). Factored out so the #1790 review F5 dedup
+ * decision below (chain vs. separate row) asks the IDENTICAL question the main
+ * loop will ask, rather than a second hand-written approximation of it that
+ * could drift from the real gates.
+ */
+function isEligibleForDriftCheck(entry) {
+    if (entry.stale)
+        return false;
+    if (entry.recordedAtMs === undefined)
+        return false;
+    return (entry.sources !== undefined &&
+        entry.sources.length > 0 &&
+        entry.sources.every((source) => source === "lsp"));
+}
+/**
+ * Freshness sweep over every blocking row the widget currently serves — the cached
+ * inline blockers (`RuntimeCoordinator`) AND, since #1790, any widget-store row
+ * reached only through a cache-served replay (`options.additionalEntries`, injected
+ * by the call site to avoid an import cycle with `widget-state.ts`). Called at turn
+ * end before the blockers are re-served. Entries whose own file or forward imports
+ * drifted since the verdict are demoted via `demote`; the turn-end renderer then
+ * serves them out of the advisory channel with a `[stale — re-run to confirm]`
+ * marker instead of as an authoritative blocker.
+ *
+ * #1790: a file present in BOTH stores — the common case, since a live dispatch
+ * writes an inline blocker (`runtime-tool-result.ts`) AND a widget-store record
+ * (`pipeline.ts`) for the SAME verdict — is drift-checked ONCE, via its
+ * inline-blocker entry, so the sweep's one drift check never runs twice over the
+ * same file WHEN that inline entry is itself eligible for the check. But
+ * `markInlineBlockerStale` only ever touches `RuntimeCoordinator`'s map, never
+ * the widget store; on drift for a duplicated path, the widget demote is
+ * CHAINED onto the inline entry's `demote` (both stores write) rather than the
+ * widget row being silently dropped — the reviewer's F1 probe caught an earlier
+ * revision that discarded it: `revalidated:1` while the widget's own
+ * `isBlocking` for the file still read true, the exact ghost #1790 exists to
+ * kill.
+ *
+ * #1790 review F5: chaining is conditional on the inline entry actually being
+ * ELIGIBLE for the drift check (`isEligibleForDriftCheck` — not already stale,
+ * timestamped, all-LSP sources). An ineligible inline entry never reaches
+ * `demote()` in the loop below, so chaining onto one is ALSO a silent drop —
+ * just one store removed from F1's. The widget row's eligibility belongs to the
+ * WIDGET STORE, not to whatever inline entry happens to share its file path; an
+ * ineligible duplicate therefore gets its own separate population row instead
+ * of being chained, so a file can legitimately count twice (once per store) when
+ * the two stores disagree on eligibility.
+ *
+ * Never throws: any internal failure leaves the entry untouched (existing re-serve
+ * behavior) rather than failing the turn end.
+ */
+export async function sweepInlineBlockerFreshness(runtime, cwd, options) {
+    const counts = {
+        total: 0,
+        kept: 0,
+        revalidated: 0,
+        alreadyStale: 0,
+        truncatedImports: 0,
+    };
+    const resolveForwardImports = options?.resolveForwardImports ?? extractForwardImportPaths;
+    let turnIndex;
+    try {
+        turnIndex = runtime.turnIndex;
+    }
+    catch {
+        turnIndex = undefined;
+    }
+    let inlineEntries;
+    try {
+        inlineEntries = runtime.getInlineBlockersSnapshot();
+    }
+    catch {
+        return counts;
+    }
+    const population = inlineEntries.map((entry) => ({
+        filePath: entry.filePath,
+        stale: entry.stale ?? false,
+        recordedAtMs: entry.recordedAtMs,
+        sources: entry.sources,
+        demote: () => runtime.markInlineBlockerStale(entry.filePath, "dependency-drift"),
+    }));
+    // #1790 review F2: dedup key is `normalizeEphemeralMapKey`, not
+    // `normalizeMapKey` — the latter realpaths a live file and walks up the
+    // directory tree for a missing one (measured ~313µs per deleted path, exactly
+    // the population this sweep processes) on a turn-end hot path. The widget
+    // store this population is reconciled against keys on
+    // `normalizeEphemeralMapKey` too (see `widget-state.ts`'s module doc on why
+    // `normalizeMapKey` is wrong for this in-process, single-walk kind of key),
+    // so this also keeps the dedup consistent with the store it is deduping
+    // against, not just cheaper.
+    const inlineByKey = new Map();
+    for (const entry of population) {
+        inlineByKey.set(normalizeEphemeralMapKey(entry.filePath), entry);
+    }
+    for (const extra of options?.additionalEntries ?? []) {
+        const key = normalizeEphemeralMapKey(extra.filePath);
+        const inlineEntry = inlineByKey.get(key);
+        // #1790 review F5: chaining onto an INELIGIBLE inline entry is a silent
+        // drop, not a merge. The main loop below short-circuits BEFORE ever
+        // calling `demote()` for an already-stale entry (the one-way
+        // dependency-drift latch — a forever-ghost once it fires once), an
+        // unstamped legacy record, or a non-LSP/mixed-sources entry (e.g. an
+        // unrelated ast-grep finding on the same file). Any of those swallows a
+        // chained widget demote even though the widget row is pure-LSP by
+        // construction (`getWidgetBlockingFilesForSweep` only emits LSP-sourced
+        // rows) and carries its OWN baseline. Eligibility belongs to the STORE
+        // the row came from, not the file path two stores happen to share — so
+        // only chain when the inline entry would itself reach `demote()`;
+        // otherwise give the widget row its own population entry so its own
+        // gates and its own drift check decide its own fate.
+        if (inlineEntry && isEligibleForDriftCheck(inlineEntry)) {
+            // #1790 review F1: a duplicated path is counted and drift-checked ONCE
+            // (via the inline entry above), but BOTH stores must record the
+            // verdict — `markInlineBlockerStale` only ever touches
+            // `RuntimeCoordinator`'s map, so without this chain the widget store's
+            // own diagnostic for this file stays fully blocking (`isBlocking` true)
+            // even after the inline entry demotes. Chain, don't replace: either
+            // store's own untouched failure path must not suppress the other's
+            // write.
+            const demoteInline = inlineEntry.demote;
+            const demoteWidget = extra.demote;
+            inlineEntry.demote = () => {
+                const inlineChanged = demoteInline();
+                const widgetChanged = demoteWidget();
+                return inlineChanged || widgetChanged;
+            };
+            continue;
+        }
+        population.push({
+            filePath: extra.filePath,
+            stale: false,
+            recordedAtMs: extra.recordedAtMs,
+            sources: ["lsp"],
+            demote: extra.demote,
+        });
+    }
+    counts.total = population.length;
+    for (const entry of population) {
+        try {
+            if (entry.stale) {
+                counts.alreadyStale += 1;
+                continue;
+            }
+            // No timestamp baseline (legacy/unstamped record) — we cannot order disk
+            // mtimes against the verdict, so leave it untouched (fail toward the
+            // existing behavior rather than fabricating a drift signal).
+            if (entry.recordedAtMs === undefined) {
+                counts.kept += 1;
+                continue;
+            }
+            // #1631 review F4: fail-closed on non-LSP (or unknown) provenance. Import
+            // drift only invalidates a language-server verdict; a mixed or non-`"lsp"`
+            // `sources` list is kept at full authority rather than demoted.
+            const isLspSourced = entry.sources !== undefined &&
+                entry.sources.length > 0 &&
+                entry.sources.every((source) => source === "lsp");
+            if (!isLspSourced) {
+                counts.kept += 1;
+                continue;
+            }
+            const { drifted, truncated } = await detectDrift(cwd, entry.filePath, entry.recordedAtMs, resolveForwardImports, turnIndex);
+            if (truncated)
+                counts.truncatedImports += 1;
+            if (drifted.length > 0) {
+                entry.demote();
+                counts.revalidated += 1;
+            }
+            else {
+                counts.kept += 1;
+            }
+        }
+        catch {
+            // Per-entry failure: keep the entry as-is.
+            counts.kept += 1;
+        }
+    }
+    return counts;
+}